Anomaly detection relating to communications using information embedding

ABSTRACT

Anomalies associated with events relating to users or user accounts can be detected. An anomaly detection management component (ADMC) determines embedded arrays comprising data bit groups representative of groups of properties and groups of relationships between properties associated with users, based on analysis of data related to events associated with users. ADMC trains a neural network (NN) based on applying embedded arrays to NN, in accordance with an artificial intelligence (AI) analysis process. ADMC determines an embedded array comprising data bits representative of properties and relationships between properties associated with a user based on analysis of data associated with the user. Trained NN can determine a pattern relating to the properties and relationships associated with the user based on AI-based analysis of the embedded array. Trained NN can detect an anomaly in the pattern based on AI-based analysis of the pattern, wherein the anomaly relates to an event.

TECHNICAL FIELD

This disclosure relates generally to electronic communications, e.g., toanomaly detection relating to communications using informationembedding.

BACKGROUND

Communication devices (and associated users) can communicate andotherwise interact with each other for a variety of purposes andapplications. For instance, users can utilize communication devices forrecreational purposes, entertainment purposes, business purposes,education purposes, or other desired purposes. Users can have useraccounts and/or subscriptions with one or more entities (e.g.,communication service provider, such as a wireless phone serviceprovider, Internet service provider, and/or cable or satellite serviceprovider) that can offer or provide products (e.g., smart phones,electronic tablets, computers, or other devices) and services (e.g.,communication-related services) to the users.

The above-described description is merely intended to provide acontextual overview regarding electronic communications and is notintended to be exhaustive.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a block diagram of an example system that candesirably detect anomalies relating to events and associated with users(e.g., associated with user accounts or communication devices associatedwith users), in accordance with various aspects and embodiments of thedisclosed subject matter.

FIG. 2 depicts a block diagram of an example anomaly detectionmanagement component, in accordance with various aspects and embodimentsof the disclosed subject matter.

FIG. 3 depicts a diagram of example respective embedded arrayscomprising bits of data that can be representative of respectiveproperties associated with respective users, in accordance with variousaspects and embodiments of the disclosed subject matter.

FIG. 4 depicts a diagram of example respective space-timerepresentations associated with respective groups of properties andrespective groups of relationships between properties associated withrespective users, in accordance with various aspects and embodiments ofthe disclosed subject matter.

FIG. 5 illustrates a diagram of example respective embedded arrayscomprising respective groups of bits of data that can be representativeof respective groups of properties and respective groups ofrelationships between properties associated with respective users, inaccordance with various aspects and embodiments of the disclosed subjectmatter.

FIG. 6 illustrates a diagram of an example neural network training andanomaly detection process flow 600, in accordance with various aspectsand embodiments of the disclosed subject matter.

FIG. 7 illustrates a flow chart of an example method that can desirablydetect anomalies relating to events and associated with users (e.g.,associated with user accounts or communication devices associated withusers), in accordance with various aspects and embodiments of thedisclosed subject matter.

FIG. 8 depicts a flow chart of an example method that can desirablytrain a neural network that can be utilized to detect anomalies relatingto events and associated with users (e.g., associated with user accountsor communication devices associated with users), in accordance withvarious aspects and embodiments of the disclosed subject matter.

FIG. 9 depicts a flow chart of another example method that can desirablydetect anomalies relating to events and associated with users (e.g.,associated with user accounts or communication devices associated withusers), in accordance with various aspects and embodiments of thedisclosed subject matter.

FIG. 10 depicts a block diagram of example communication device, inaccordance with various aspects and embodiments of the disclosed subjectmatter.

FIG. 11 illustrates a block diagram of an example access point, inaccordance with various aspects and embodiments of the disclosed subjectmatter.

FIG. 12 is a schematic block diagram illustrating a suitable computingenvironment in which the various embodiments of the embodimentsdescribed herein can be implemented.

DETAILED DESCRIPTION

Various aspects of the disclosed subject matter are now described withreference to the drawings, wherein like reference numerals are used torefer to like elements throughout. In the following description, forpurposes of explanation, numerous specific details are set forth inorder to provide a thorough understanding of one or more aspects. It maybe evident, however, that such aspect(s) may be practiced without thesespecific details. In other instances, well-known structures and devicesare shown in block diagram form in order to facilitate describing one ormore aspects.

Users can use communication devices to communicate and otherwiseinteract with each other for a variety of purposes and applications. Forinstance, users can utilize communication devices for recreationalpurposes, entertainment purposes, business purposes, education purposes,or other desired purposes. Users can have user accounts and/orsubscriptions with one or more entities (e.g., communication serviceprovider, such as a wireless phone service provider, Internet serviceprovider, and/or cable or satellite service provider) that can offer orprovide products (e.g., smart phones, electronic tablets, computers, orother devices) and services (e.g., communication-related services) tothe users.

Sometimes unauthorized entities (e.g., malicious, criminal, or otherwiseunauthorized users or entities) can attempt to engage in undesirable(e.g., unauthorized, fraudulent, criminal, or otherwise undesirable)activities against user accounts associated with users and an entity(e.g., a service or product provider) with which the users can beassociated. For example, an unauthorized entity can representitself/himself/herself (e.g., can attempt to pass itself/himself/herselfoff) as being a user associated with a user account to an entity withwhich the user has a user account, and can improperly (e.g.,fraudulently or criminally) attempt to purchase or upgrade to a newcommunication device (e.g., a new smart phone) under the user account ofthe user, where the cost of the new communication device can beimproperly charged to the user (e.g., charged to the user account of theuser and/or a financial account of the user that can be associated withthe user account). Some of these unauthorized entities can be relativelysavvy, and it can often be difficult to identify some of theseunauthorized entities as being unauthorized with respect to a useraccount of a user.

Fraud can cost businesses a significant amount of money each year. Tocombat fraud, some existing business processes can rely on makingindividual determinations regarding whether an instance of fraud isoccurring, which can be undesirably expensive to do on an individualbasis and usually can undesirably involve deploying considerableresources (e.g., personnel resources, time resources, equipmentresources, or other resources).

To that end, techniques for desirably detecting anomalies associatedwith events relating to users, user accounts, or communication devicesare presented. The disclosed subject matter an anomaly detectionmanagement component (ADMC) that can determine respective embeddedarrays comprising respective groups of bits of data that can berepresentative of respective groups of properties and respective groupsof relationships between properties associated with respective users,based at least in part on an analysis of data related to events,interactions, activities, or communications associated with the usersthat can span a desired period(s) of time.

The ADMC can apply (e.g., input) the respective embedded arrays to aneural network. Based at least in part on the application of theembedded arrays (e.g., the respective groups of bits of data of theembedded arrays) to the neural network, the neural network can betrained to create a trained neural network, in accordance with anartificial intelligence (AI) analysis process and associated AI-basedalgorithm and techniques.

With regard to a particular user (e.g., user account or communicationdevice associated with the user), the ADMC can determine an embeddedarray comprising bits of data that can be representative of respectiveproperties and respective relationships between the respectiveproperties associated with the user based at least in part on ananalysis of data associated with the user (e.g., data relating toevents, interactions, activities, or communications associated with theuser, user account associated with the user, or communication device(s)associated with the user). The ADMC can apply the embedded array to thetrained neural network. The trained neural network can determine apattern relating to the respective properties and the respectiverelationships between the respective properties associated with the userbased at least in part on an AI-based analysis of the bits of data ofthe embedded array. The trained neural network can detect (e.g., canautomatically, dynamically, and/or intelligently detect) an anomaly inthe pattern based at least in part on an AI-based analysis of thepattern, wherein the anomaly can relate to an event(s), interaction(s),activity(ies), or communication(s) associated with the user (e.g.,associated with the user account or communication device associated withthe user). The anomaly can be indicative of, for example, fraudulentactivity associated with (e.g., against) the user account of the user,churn associated with the user account, robocall activity, spamactivity. For example, the fraudulent activity, or potential fraudulentactivity, comprise a fraudulent attempt to purchase or upgrade to a newcommunication device (e.g., a new smart phone charged under the useraccount of the user), a fraudulent attempt to swap a subscriber identitymodule (SIM) card associated with a communication device associated withthe user account, a fraudulent attempt to add a line to the user account(e.g., where the new line can be utilized by a device of the fraudulententity while the cost of the new line can be charged to the user accountof the user), or other type of fraudulent activity associated with theuser account of the user.

The ADMC can present (e.g., communicate or display) information (e.g.,notification or alert message comprising information) relating to theanomaly to an entity, another device or component, and/or the user tofacilitate notifying the entity, the other device or component, and/orthe user of the detected anomaly associated with the user (e.g.,associated with the user account or communication device of the user).This can enable the entity (e.g., human or virtual assistant (VA)representative associated with the entity), the other device orcomponent (or the ADMC), and/or the user to take a desired action (e.g.,responsive or mitigation action) to determine whether the anomalyactually involves undesired (e.g., unauthorized, fraudulent, criminal,and/or otherwise undesired) activity and/or prevent (e.g., block) ormitigate the undesired activity (if it is determined that there isundesired activity) and/or prevent uncharacterized activity (e.g., as aprecautionary measure, prevent, or at least temporarily prevent, anactivity that has not (at least yet) been determined to be undesired).If, for example, the anomaly relates to potential churn associated withthe user, the entity (e.g., representative associated with the entity)can take a desired action (e.g., present an offer for a communicationdevice, other product, and/or service) to the user.

The disclosed subject matter, by employing the ADMC, trained neuralnetworks, and the techniques described herein, can enhance (e.g.,improve or optimize) detection of undesired (e.g., unauthorized,fraudulent, criminal, and/or otherwise undesired) activities associatedwith user accounts or communication devices associated with users, andmitigation and prevention of such undesired activities, as compared toexisting techniques for detecting unauthorized or fraudulent activities.Also, the disclosed subject matter, by employing the ADMC, trainedneural networks, and the techniques described herein, can mitigate(e.g., reduce or minimize) or prevent churn associated with useraccounts and associated products and services. In accordance withvarious embodiments, the disclosed subject matter, by employing theADMC, trained neural networks, and the techniques described herein, canmitigate (e.g., reduce or minimize) or prevent undesired robocalls orspam calls associated with a communication device of the user, and/orattacks against the communication network. The disclosed subject matter,by employing the ADMC, trained neural networks, and the techniquesdescribed herein, also can enhance sales and marketing of products andservices to users (e.g., customers or potential customers).

These and other aspects and embodiments of the disclosed subject matterwill now be described with respect to the drawings.

Referring now to the drawings, FIG. 1 illustrates a block diagram of anexample system 100 that can desirably detect anomalies relating toevents and associated with users (e.g., associated with user accounts orcommunication devices associated with users), in accordance with variousaspects and embodiments of the disclosed subject matter. The system 100can comprise a communication network 102 that can comprise a packet datanetwork (e.g., an Internet Protocol (IP)-based network, such as theInternet and/or intranet) and/or a mobility core network (e.g., awireless communication network), wherein the packet data network can beassociated with (e.g., communicatively connected to) the mobility corenetwork. The packet data network can be or can comprise the Internet oran intranet. The communication network 102 can comprise various networkequipment 104 that can facilitate communication of data traffic in orassociated with the communication network 102. The network equipment 104can comprise servers, routers, access points (e.g., base stations orcells, or other type of access point), gateways, modems, network nodes,hubs, bridges, switches, processors, data stores, or other type ofnetwork equipment that can facilitate wireline or wireless communicationof data traffic in or associated with the communication network 102. Thenetwork equipment 104 also can comprise or facilitate the generation(e.g., creation) or instantiation of virtualized network equipment,components, and/or functions (e.g., virtualized processors, servers,controllers, applications, and/or other desired components orfunctions), which can be employed, for example, to facilitate edgecomputing and services (e.g., mobile edge computing and other edgeservices), network slicing (e.g., generation or instantiation of networkslices), network security, and/or other desired network uses orservices.

At various times, communication devices, such as, for example,communication device 106, communication device 108, and/or communicationdevice 110, associated with users, such as user 112, user 114, and user116, can be associated with (e.g., communicatively connected to) thecommunication network 102 to communicate with other communicationdevices that are associated with the communication network 102. Forinstance, a user (e.g., 112) can utilize a communication device (e.g.,106) to make a phone call or communicate a message via the communicationnetwork 102, to another communication device (e.g., 108) to communicateinformation to the other communication device or request informationfrom the other communication device. A communication device (e.g., 106)can communicate with the communication network 102 using a wirelesscommunication connection or a wireline communication connection.

A communication device (e.g., 106, 108, or 110) also can be referred toas, for example, a device, a mobile device, a mobile communicationdevice, user equipment (UE), a terminal, or a mobile terminal, or byother similar terminology. A communication device can refer to any typeof wireline device or wireless device that can communicate with thecommunication network 102, wherein a wireless device can communicatewith a radio network node in a core network (e.g., a cellular or mobilecommunication system) of the communication network 102. Examples ofcommunication devices can include, but are not limited to, a computer(e.g., a desktop computer, a server, a laptop embedded equipment (LEE),a laptop mounted equipment (LME), or other type of computer), a phone(e.g., a smart phone, cellular phone, or other type of phone that canutilize applications), a tablet or pad (e.g., an electronic tablet orpad), an electronic notebook, a Personal Digital Assistant (PDA), adevice to device (D2D) UE, a machine type UE or a UE capable of machineto machine (M2M) communication, a smart meter (e.g., a smart utilitymeter), a target device, devices and/or sensors that can monitor orsense conditions (e.g., health-related devices or sensors, such as heartmonitors, blood pressure monitors, blood sugar monitors, healthemergency detection and/or notification devices, or other type of deviceor sensor), a broadband communication device (e.g., a wireless, mobile,and/or residential broadband communication device, transceiver, gateway,and/or router), a dongle (e.g., a Universal Serial Bus (USB) dongle), anelectronic gaming device, electronic eyeglasses, headwear, or bodywear(e.g., electronic or smart eyeglasses, headwear (e.g., augmented reality(AR) or virtual reality (VR) headset), or bodywear (e.g., electronic orsmart watch) having wireless communication functionality), a music ormedia player, speakers (e.g., powered speakers having wirelesscommunication functionality), an appliance (e.g., a toaster, a coffeemaker, a refrigerator, or an oven, or other type of appliance havingwireless communication functionality), a set-top box, an IP television(IPTV), a device associated or integrated with a vehicle (e.g.,automobile, airplane, bus, train, or ship, or other type of vehicle), avirtual assistant (VA) device, a drone, a home or building automationdevice (e.g., security device, climate control device, lighting controldevice, or other type of home or building automation device), anindustrial or manufacturing related device, a farming or livestock ranchrelated device, and/or any other type of communication devices (e.g.,other types of IoTs).

Users (e.g., 112, 114, and 116) can have user accounts and/orsubscriptions with one or more entities (e.g., service or productproviders), such as entity 118, that can offer and/or provide products(e.g., communication devices, accessories for communication devices, orother products) and services (e.g., communication-related services) tothe users. The entity 118 can have one or more representatives (e.g.,sales, service, or technical support representatives) who can act onbehalf of the entity 118, wherein the one or more representatives can behuman users or VAs. The entity 118 can have one or more communicationdevices, such as communication device 120, that can be associated with(e.g., communicatively connected to) the communication network 102 andcan be used by the representatives of the entity 118 to interact withcustomers and/or potential customers, such as one or more of the users(e.g., 112, 114, and/or 116).

There can be instances where an unauthorized entity 122 (e.g.,malicious, criminal, or otherwise unauthorized user or entity) canattempt to engage in undesirable (e.g., unauthorized, fraudulent,criminal, or otherwise undesirable) activities against a user account(s)associated with a user(s) (e.g., user 112) and an entity (e.g., entity118) with which the users (e.g., 112, 114, and/or 116) can beassociated. In some instances, the unauthorized entity 122 is able toprovide identification or authentication information relating to a user(e.g., user 112) and or user account of the user that can be sufficientto convince a device or a representative associated with the entity 118that the unauthorized entity 122 is the user and/or is otherwiseauthorized to engage in activity (e.g., purchase products or services)associated with or under the user account of the user (e.g., user 112).As some examples, an unauthorized entity 122 can utilize a communicationdevice 124 to improperly (e.g., fraudulently or illegally) represent asbeing a user (e.g., user 112) associated with a user account to theentity 118 with which the user has a user account, and can improperly(e.g., fraudulently or illegally) attempt to purchase or upgrade to anew communication device (e.g., a new smart phone) under the useraccount of the user, where the cost of the new communication device canbe improperly charged to the user (e.g., charged to the user account ofthe user and/or a financial account of the user that can be associatedwith the user account), attempt to add a line to the user account of theuser, attempt to change (e.g., swap) SIM cards associated with the useraccount of the user, and/or attempt to add the unauthorized entity 122or another unauthorized entity as an “authorized user” on the useraccount. Other undesirable activities the unauthorized entity 122 canengage in can include, for example, robocalls and spam calls. It can bedesirable to detect such unauthorized and/or undesirable activities byunauthorized entities, such as unauthorized entity 122, and associatedcommunication devices (e.g., communication device 124), and prevent ormitigate such unauthorized and/or undesirable activities by unauthorizedentities.

In accordance with various embodiments, to facilitate detecting,preventing, and/or mitigating such unauthorized and/or undesirableactivities by unauthorized entities, the system 100 can comprise ananomaly detection management component (ADMC) 126 that can desirably(e.g., suitably, acceptably, and/or optimally; and automatically,dynamically, and/or intelligently) detect, determine, identify, infer,or predict anomalies associated with users (e.g., associated with useraccounts associated with users (e.g., 112, 114, and/or 116) based atleast in part on analysis of data relating to events, interactions,activities, or communications associated with (or ostensibly associatedwith) users and/or previous analysis of data relating to previousevents, interactions, activities, or communications associated withusers (e.g., other users), in accordance with defined anomaly detectioncriteria, such as more fully described herein. An anomaly can beindicative of, and/or can relate or potentially can relate to,undesirable (e.g., unauthorized, fraudulent, improper, criminal,unwanted, or otherwise undesirable) activity (e.g., undesirably activityassociated with a user, user account of the user, or communicationdevice associated with the user), such as described herein. Inaccordance with various embodiments, the ADMC 126 can be part of thecommunication network 102, can be associated with the communicationnetwork 102 (e.g., can be located outside of but communicativelyconnected to the communication network 102), or a desired combinationthereof.

Referring to FIG. 2 (along with FIG. 1 ), FIG. 2 depicts a block diagramof an example ADMC 126, in accordance with various aspects andembodiments of the disclosed subject matter. As shown in FIG. 2 , theADMC 126 can comprise an interface component 202, a property component204, a relationship component 206, a mapper component 208, and an AIcomponent 210, which can include a neural network component 212, atraining component 214, and a pattern component 216. The ADMC 126 alsocan comprise an anomaly detector component 218, a notification component220, a response component 222, an operations manager component 224, aprocessor component 226, and a data store 228.

The ADMC 126 can obtain (e.g., receive, collect, and/or aggregate), viathe communication network 102, a large amount (e.g., volume) of datarelating to the communication network 102, communication devices (e.g.,106 108, 120 and/or 124), users (e.g., 112, 114, and/or 116), entities(e.g., entities, such as entity 118, and/or unauthorized entities, suchas unauthorized entity 122), services (e.g., services of or associatedwith the communication network 102), applications (e.g., applications ofor associated with the communication network 102), user accountsassociated with users, products, events, interactions, activities,and/or communications. Some of the data can relate to, for example,events relating to users, communication devices, and/or user accountsassociated with the users; interactions or communications between usersand other users and/or between communication devices of users and othercommunication devices of other users; and/or activities associated withusers, communication devices, and/or user accounts associated with theusers. Some of the data (e.g., global positioning system (GPS) data,network measurement or network-related data, or other location-relateddata) can relate to locations of communication devices associated withusers. The network measurement or network-related data can comprise, forexample, reference signal received power (RSRP), reference signalreceived quality (RSRQ), radio resource control (RRC) measurements,signal to interference plus noise ratio (SINR), received signal strengthindicator (RSSI), channel quality indicator (CQI), throughput,throughput rate, bandwidth, quality of service (QoS), quality ofexperience (QoE), call data records (CDRs), and/or other networkmeasurements or data.

The interface component 202 can be or can comprise one or more gateways,one or more application programming interfaces (APIs), one or moregraphical user interfaces (GUIs), one or more other interfaces, and/orone or more other tools that can facilitate (e.g., enable) communicationof data between the ADMC 126 and communication devices or other devices(e.g., network equipment 104), and/or facilitate presenting (e.g.,displaying or communicating) desired data to users. The ADMC 126 canreceive data from the communication network 102 and/or communicationdevices (e.g., 106 108, 120 and/or 124) via the interface component 202and can communicate data to the communication network 102 and/orcommunication devices (e.g., 106 108, 120 and/or 124) via the interfacecomponent 202.

The ADMC 126 can analyze the data (e.g., data relating to users,communication devices, user accounts associated with users, events,interactions, activities, or communications) to facilitate determiningor identifying properties associated with users and relationshipsbetween the properties, which can be utilized to facilitate detectinganomalies relating to events, interactions, activities, orcommunications associated with users (e.g., associated with useraccounts or communication devices associated with users). In someembodiments, the ADMC 126 can employ the AI component 210 (e.g., inconjunction with the property component 204 and/or relationshipcomponent 206) to perform an AI-based analysis (e.g., AI, machinelearning (ML), or other type of AI analysis) on the data, using desiredAI-based algorithms, models, and/or techniques, to facilitatedetermining or identifying properties associated with users andrelationships between the properties.

The ADMC 126, employing the property component 204, relationshipcomponent 206, mapper component 208, and/or AI component 210, can mapactivities, events, properties, and relationships between properties toan embedded array solution space (e.g., a bitmap solution space), andthe ADMC 126 can utilize the embedded array of that embedded arraysolution space to train a neural network to be a trained neural network(e.g., trained discriminative neural network) that can detect whetherthere are any anomalies in embedded arrays analyzed using the trainedneural network, as more fully described herein.

The property component 204 can determine or identify respective groupsof properties (e.g., attributes or characteristics) associated withrespective users (e.g., users 112, 114, and/or 116) and relating torespective events, interactions, activities, or communicationsassociated with the respective users based at least in part on theresults of the analysis of such data. A property can relate to, forexample, a “user” (e.g., where the “user” can be a user (e.g., 112)actually associated with the user account or an unauthorized entity 122representing himself/herself/itself as being the user) requesting anupgrade, or upgrading, of a communication device and/or requesting topurchase, or purchasing, a communication device, a “user” requesting toadd or adding another entity to the user account, a “user” attempting toadd a line or adding a line to the user account, a “user” interactingwith a webpage(s) of an online store of the entity 118 (e.g., where thewebpage(s) presents offers relating to products or services), a “user”requesting to swap, or swapping, a SIM card associated with the useraccount to a different SIM card, a location from which the “user” iscontacting the entity 118 or a representative of the entity 118 withregard to the user account (e.g., to add an authorized user to the useraccount, to add a line to the user account, to upgrade communicationdevice, or to take another action with regard to the user account), alocation of the communication device (e.g., 106) associated with theuser account, a usage state or type of usage of the communication device(e.g., 106) associated with the user account, a robocall, a spam call,and/or a “user” having or associated with another type of event,interaction, activity, or communication (e.g., in connection with theuser account).

The relationship component 206 can determine or identify respectivegroups of relationships between properties associated with therespective users (e.g., users 112, 114, and/or 116) based at least inpart on the results of the analysis of such data, including therespective groups of properties determined or identified by the propertycomponent 204. A relationship between properties can provide orfacilitate providing context between the properties associated with therelationship. A relationship between properties can relate to, forexample, an amount of time that has elapsed between a first event,interaction, activity, or communication associated with a first propertyand a second event, interaction, activity, or communication associatedwith a second property, a first location associated with the firstproperty in relation to a second location associated with the secondproperty, a relationship between a first type of property (e.g., a firsttype of event, interaction, activity, or communication associated withthe first property) and a second type of property (e.g., a second typeof event, interaction, activity, or communication associated with thesecond property), and/or another type of relationship between at leasttwo properties. In some embodiments, the relationship component 206 candetermine that there is more than one relationship (e.g., timerelationship, location or spatial relationship, and/or another type ofrelationship) between two properties, the relationship is a complex(e.g., multi-dimensional) relationship between two properties (e.g., acomplex relationship comprising a time-related component, a location orspatial-related component, and/or another type of relationshipcomponent), and/or the relationship is between more than two properties.

Based at least in part on the respective groups of properties (e.g.,attributes or characteristics) associated with respective users (e.g.,users 112, 114, and/or 116) and/or the respective groups ofrelationships between properties associated with the respective users,the mapper component 208 can embed, map, or code the respective groupsof properties associated with the respective users (e.g., users 112,114, and/or 116) and/or the respective groups of relationships betweenproperties to generate respective embedded arrays comprising respectivegroups of bits of data that can be representative of (e.g., can relateor correspond to, or can be indicative of) the respective events,interactions, activities, or communications associated with therespective users. The mapper component 208 can embed or map propertiesand relationships between properties in an embedded array, comprisingbits of data, such that the embedded array can represent a fingerprintof the properties, relationships between properties, and associatedevents and activities for any given type of entity (e.g., a user accountassociated with a user). For instance, for each property of a group ofproperties associated with a user (e.g., associated with a user accountor communication device associated with the user (e.g., 112, 114, or116)), the mapper component 208 can embed, map, or code a property byinserting a particular bit of data having a particular bit value to aparticular bit location in the embedded array based at least in part onthe type of property, the context associated with the property (e.g.,context of or associated with an event, interaction, activity, orcommunication associated with the property), an outcome associated withthe property, a cost, magnitude, or other value associated with theproperty, and/or another feature associated with the property. Amagnitude or other type of value can be or can relate to, for example, atime value (e.g., a particular time, an amount of time, or othertime-related value), a location-related value (e.g., GPS coordinatevalue, geospatial coordinate value, a distance value (e.g., distancebetween two locations, entities, or things), or other location-relatedvalue), or other desired type of magnitude or value. The bit value ofthe bit of data and the location of the bit of data in the embeddedarray can be representative or indicative of the property. For instance,a first type of property can be associated with a first bit of data in afirst location (e.g., first slot or cell) of the embedded array, and asecond type of property can be associated with a second bit of data in asecond location (e.g., second slot or cell) of the embedded array. A bitof data (e.g., an item of data in a slot of the embedded array) cancontain, for example, a Boolean value (e.g., binary digit, such as 1 or0 (or can be an empty bit location)), an integer value, a floating pointnumber, a complex value, a shape (e.g., a shape representative of avalue), an indicator (e.g., an indicator representative of a value), oran alphanumeric value. In some embodiments, an embedded array can be orcan comprise a bitmap.

For each relationship of a group of relationship between propertiesassociated with a user (e.g., associated with a user account orcommunication device associated with the user (e.g., 112, 114, or 116)),the mapper component 208 can embed, map, or code a relationship betweenproperties by inserting a particular bit of data having a particular bitvalue to a particular bit location in the embedded array based at leastin part on the type of relationship, the context associated with therelationship (e.g., context of or associated with events, interactions,activities, or communications associated with the properties that arerelated), an outcome associated with the relationship, a cost(s),magnitude(s), or other value(s) associated with the propertiesassociated with the relationship, and/or another feature associated withthe relationship between properties. The bit value of the bit of dataand the location of the bit of data in the embedded array can berepresentative or indicative of the relationship between properties. Forinstance, a first type of relationship between properties can beassociated with a first bit of data in a first location of the embeddedarray, and a second type of relationship between properties can beassociated with a second bit of data in a second location of theembedded array. In some embodiments, the location of the bit of datarelating to (e.g., representative or indicative of) a relationshipbetween properties in the embedded array can based at least in part onthe respective locations of the bits of data relating to the propertiesin the embedded array.

In certain embodiments, the mapper component 208 can embed, map, or codea property or a relationship between properties by inserting aparticular bit of data to one location of respective bit locations inthe embedded array based at least in part on the property orrelationship type, the context associated with the property orrelationship, an outcome associated with the property or relationship, acost(s), magnitude(s), or other value(s) associated with the property orrelationship, and/or another feature associated with the property orrelationship. For example, if Boolean values are being utilized, withregard to a relationship between a first property associated with afirst event and a second property associated with a second event, themapper component 208 can insert the bit of data in one of two or morebit locations in the embedded array based at least in part on, e.g., avalue(s) (e.g., a cost(s), magnitude(s), or other value(s)) associatedwith the properties or the relationship, wherein the number of bitlocations allocated as being available to represent the relationship inthe embedded array can be as desired, in accordance with the definedanomaly detection criteria. For instance, if there are three availablebit locations allocated in the embedded array to represent therelationship, the mapper component 208 can insert the bit of data (e.g.,a 1 value) in a first bit location of the embedded array if the valueassociated with the relationship is a first value or within a firstrange of values (e.g., 0 to 5 hours; or 0 to 5 miles), can insert thebit of data (e.g., a 1 value) in a second bit location of the embeddedarray if the value associated with the relationship is a second value orwithin a second range of values (e.g., greater than 5 hours to 10 hours;or greater than 5 miles to 10 miles), or can insert the bit of data(e.g., a 1 value) in a third bit location of the embedded array if thevalue associated with the relationship is a third value or within athird range of values (e.g., greater than 10 hours to 20 hours (or anyvalue greater than 20 hours); or greater than 10 miles to 20 miles (orany value greater than 20 hours)).

In some embodiments, the ADMC 126 can compress the bits of data in theembedded array to, for example, reduce the amount of space utilized bythe bits of data of the embedded array. For instance, an embedded arraymay comprise a relatively larger number of bit locations (e.g., 64 bitlocations, 128 bit locations, or more) and may have a significant numberof bit locations that do not contain a bit of data (e.g., empty bitlocations) or that contain a same data bit value. The ADMC 126 cancompress the bits of data of the embedded array using a desired datacompression algorithm and techniques.

Referring to FIG. 3 (along with FIGS. 1 and 2 ), FIG. 3 depicts adiagram of example respective embedded arrays 300 comprising bits ofdata that can be representative of respective properties associated withrespective users, in accordance with various aspects and embodiments ofthe disclosed subject matter. The embedded arrays 300 of FIG. 3 canfacilitate illustrating certain features and aspects of the disclosedsubject matter with regard to embedded arrays. The embedded arrays 300can relate to a first group of records 302 associated with user A 304,and a second group of records 306 associated with user B 308, whereinthe first group of records 302 and the second group of records 306 canhave or share the same group of properties. With regard to these examplerecord groups (e.g., 302 and 306), there can be six properties (e.g.,six types of properties), for example, comprising a first property 310(e.g., circle with “B” inside), second property 312 (e.g., circle with“G” inside), third property 314 (e.g., circle with “Y” inside), fourthproperty 316 (e.g., circle with “R” inside), fifth property 318 (e.g.,circle with “0” inside), and sixth property 320 (e.g., circle with “V”inside). As can be observed, while the first group of records 302 andthe second group of records 306 have the same six properties, theproperties are in different orders in the first group of records 302 andthe second group of records 306. These properties (e.g., 310 through320) can be determined by the property component 204 based at least inpart on the results of analyzing respective data, comprising the firstgroup of records 302 and second group of records 306, associated withuser A 304 and user B 308.

The mapper component 208 can embed the respective properties (e.g., 310through 320) associated with the first group of records 302 associatedwith user A 304 and the second group of records 306 associated with userB 308 to form (e.g., create or generate) a first embedded array 322(embedded array A) and a second embedded array 324 (embedded array B).The first embedded array 322 can comprise respective bits of data thatcan be representative of and correspond to the respective properties(e.g., 310 through 320) associated with the first group of records 302.Similarly, the first embedded array 322 can comprise respective bits ofdata that can be representative of and correspond to the respectiveproperties (e.g., 310 through 320) associated with the second group ofrecords 306. For instance, the mapper component 208 can embed the firstproperty 310 as a first bit of data 310′ in a second location 326 of thefirst embedded array 322, the second property 312 as a second bit ofdata 312′ in a fourth location 328 of the first embedded array 322, thethird property 314 as a third bit of data 314′ in a fifth location 330of the first embedded array 322, the fourth property 316 as a fourth bitof data 316′ in a seventh location 332 of the first embedded array 322,the fifth property 318 as a fifth bit of data 318′ in another location334 of the first embedded array 322, and the sixth property 320 as asixth bit of data 320′ in still another location 336 of the firstembedded array 322. Similarly, the mapper component 208 can embed thefirst property 310 as a first bit of data 310′ in a second location 338of the second embedded array 324, the second property 312 as a secondbit of data 312′ in a fourth location 340 of the second embedded array324, the third property 314 as a third bit of data 314′ in a fifthlocation 342 of the second embedded array 324, the fourth property 316as a fourth bit of data 316′ in a seventh location 344 of the secondembedded array 324, the fifth property 318 as a fifth bit of data 318′in another location 346 of the second embedded array 324, and the sixthproperty 320 as a sixth bit of data 320′ in still another location 348of the second embedded array 324.

Turning to FIG. 4 (along with FIGS. 1, 2, and 3 ), FIG. 4 depicts adiagram of example respective space-time representations 400 associatedwith respective groups of properties and respective groups ofrelationships between properties associated with respective users (e.g.,user A 304 and user B 308), in accordance with various aspects andembodiments of the disclosed subject matter. The example respectivespace-time representations 400 can comprise a first space-timerepresentation 402, representative of a first group of properties and afirst group of relationships between properties and associated with thefirst group of records 302 associated with user A 304, and a secondspace-time representation 404, representative of a second group ofproperties and a second group of relationships between properties, andassociated with the second group of records 306 associated with user B308. The first space-time representation 402 and the second space-timerepresentation 404 can have the respective properties plotted orrepresented as respective data points to account for and/or representtime features (e.g., time attributes, such as time of occurrence of anevent and/or length of time between events) and spatial featuresassociated with the properties.

The properties can comprise the example six properties referenced withregard to the embedded arrays 300 of FIG. 3 , with the propertiescomprising the first property 410 (e.g., circle with “B” inside), secondproperty 412 (e.g., circle with “G” inside), third property 414 (e.g.,circle with “Y” inside), fourth property 416 (e.g., circle with “R”inside), fifth property 418 (e.g., circle with “0” inside), and sixthproperty 420 (e.g., circle with “V” inside) (respectively correspondingto the first property 310, second property 312, third property 314,fourth property 316, fifth property 318, and sixth property 320 of theembedded arrays 300 of FIG. 3 ). As can be observed in the firstspace-time representation 402 and the second space-time representation404, while each contain the same six properties, the space-timerepresentation of the six properties in the second space-timerepresentation 404 can be different from the space-time representationof the six properties in the first space-time representation 402 due todifferences in the times that the properties occurred (e.g., times ofevents, interactions, activities, or communications, or othertime-related features) with respect to the first space-timerepresentation 402 and the second space-time representation 404, and/ordue to differences in space-related features (e.g., locations of events,interactions, activities, or communications, or other space-relatedfeatures) with respect to the first space-time representation 402 andthe second space-time representation 404.

With regard to the relationships, the relationship component 206 candetermine the respective (e.g., first and second) groups ofrelationships between properties based at least in part on the resultsof analyzing respective data, comprising the first group of records 302and second group of records 306, associated with user A 304 and user B308. For instance, based at least in part on the data analysis results,the relationship component 206 can determine the first group ofrelationships between properties comprising a relationship 422 betweensecond property 412 and fourth property 416, a relationship 424 betweenthird property 414 and fourth property 416, a relationship 426 betweensecond property 412 and third property 414, and a relationship 428between second property 412 and fifth property 418. Also, based at leastin part on the data analysis results, the relationship component 206 candetermine the second group of relationships between propertiescomprising a relationship 430 between second property 412 and fourthproperty 416, a relationship 432 between third property 414 and fourthproperty 416, and a relationship 434 between second property 412 andthird property 414. As can be observed in the first space-timerepresentation 402 and the second space-time representation 404, thefirst group of relationships (e.g., 422, 424, 426, and 428) and thesecond group of relationships (e.g., 430, 432, and 434) can havedifferences between them, for example, with regard to time and space,with regard to the number of relationships, and with regard to whichproperties have relationships to other properties.

Typically, the more properties and/or relationships that exist inembedded arrays, the more discriminating an embedded array can be interms of its use by the ADMC 126 in detecting or identifying anomalousbehaviors associated with properties and/or relationships.

Referring to FIG. 5 (along with FIGS. 1, 2, 3, and 4 ), FIG. 5illustrates a diagram of example respective embedded arrays 500comprising respective groups of bits of data that can be representativeof respective groups of properties and respective groups ofrelationships between properties associated with respective users (e.g.,user A 304 and user B 308), in accordance with various aspects andembodiments of the disclosed subject matter. As disclosed, in additionto embedding or mapping the properties to embedded arrays, the mappercomponent 208 can embed, map, or code relationships between propertiesto embedded arrays, where the relationships can be relatively basicrelationships or can be relatively more complex relationships. Theembedded arrays can be of a desired size (e.g., a desired number of bitlocations and/or bits of data). It can be desirable for an embeddedarray to be large enough in size (e.g., to have a sufficient number ofbit locations and/or bits of data) to enable the entire solution spaceto be expressed. In some embodiments, bits in the embedded array canconsistently refer to a given property or feature in the domain space orcan refer to a relationship between properties.

The respective embedded arrays 500 can comprise a first embedded array502 associated with user A 304 (e.g., corresponding to the firstembedded array 322 of FIG. 3 ) and a second embedded array 504associated with user B 308 (e.g., corresponding to the second embeddedarray 324 of FIG. 3 ). The mapper component 208 can embed the firstproperty 310 as a first bit of data 310′ in a second location 506 of thefirst embedded array 502, the second property 312 as a second bit ofdata 312′ in a fourth location 508 of the first embedded array 502, thethird property 314 as a third bit of data 314′ in a fifth location 510of the first embedded array 502, the fourth property 316 as a fourth bitof data 316′ in a seventh location 512 of the first embedded array 502,the fifth property 318 as a fifth bit of data 318′ in another location514 of the first embedded array 502, and the sixth property 320 as asixth bit of data 320′ in still another location 516 of the firstembedded array 502. Similarly, the mapper component 208 can embed thefirst property 310 as a first bit of data 310′ in a second location 518of the second embedded array 504, the second property 312 as a secondbit of data 312′ in a fourth location 520 of the second embedded array504, the third property 314 as a third bit of data 314′ in a fifthlocation 522 of the second embedded array 504, the fourth property 316as a fourth bit of data 316′ in a seventh location 524 of the secondembedded array 504, the fifth property 318 as a fifth bit of data 318′in another location 526 of the second embedded array 504, and the sixthproperty 320 as a sixth bit of data 320′ in still another location 528of the second embedded array 504.

With regard to the records of the properties of the embedded arrays 502and 504, the properties can represent what may seem like disjointed,reasonable activities that user accounts can experience. However, whenthe embedded arrays are augmented with relationships among thoseproperties, the records and associated embedded arrays can or may revealdifferent insights with regard to whether the activities associated withuser accounts are reasonable and benign (e.g., non-anomalous) or whetherthe activities are anomalous and/or fraudulent or otherwise undesirable(e.g., unreasonable, unwanted, or otherwise undesirable).

At the same time as embedding the properties and/or in parallel with theembedding of the properties in an embedding array, or at a differenttime (e.g., subsequent to) than the embedding of the properties in theembedding array, the mapper component 208 can embed, map, or code therelationships between properties to the embedding array. With regard tothe first embedded array 502, the mapper component 208 can embed, map,or code (e.g., encode) the first group of relationships to the firstembedded array 502. For instance, the mapper component 208 can embed,map, or code the relationship 422 between second property 412 and fourthproperty 416 as a bit of data 422′ in a sixth location 530 of the firstembedded array 502, the relationship 424 between third property 414 andfourth property 416 as a bit of data 424′ in another location 532 of thefirst embedded array 502, the relationship 426 between second property412 and third property 414 as a bit of data 426′ in still anotherlocation 534 of the first embedded array 502, and the relationship 428between second property 412 and fifth property 418 as a bit of data 428′in yet another location 536 of the first embedded array 502.

With regard to the second embedded array 504, the mapper component 208can embed, map, or code the second group of relationships to the secondembedded array 504. For instance, the mapper component 208 can embed,map, or code the relationship 430 between second property 412 and fourthproperty 416 as a bit of data 430′ in a sixth location 538 of the secondembedded array 504, the relationship 432 between third property 414 andfourth property 416 as a bit of data 432′ in another location 540 of thesecond embedded array 504, and a relationship 434 between secondproperty 412 and third property 414 as a bit of data 434′ in anotherlocation 542 of the second embedded array 504. In some embodiments, forconsistency and to facilitate training a neural network and/or use of atrained neural network (e.g., analyzing, comparing between, and/ordiscriminating between bit patterns of embedded arrays (e.g., by atrained neural network)), the mapper component 208 can embed or map bitsof data in embedded arrays such that a bit location (e.g., sixth bitlocation) of a bit of data representative of a relationship between afirst property and a second property in a first embedded array cancorrespond to (e.g., be the same as) a bit location (e.g., sixth bitlocation) of another bit of data representative of another relationshipbetween the first property and the second property in a second embeddedarray.

As can be observed in the first embedded array 502 and the secondembedded array 504, there can be an anomaly 544 with regard to therelationship 424 between third property 414 and fourth property 416 (ofFIG. 4 ) as indicated by the bit of data 424′ in location 532 of thefirst embedded array 502 (of FIG. 5 ), for example, in relation to therelationship 432 (e.g., corresponding relationship) between thirdproperty 414 and fourth property 416 as indicated by the bit of data432′ in location 540 of the second embedded array 504. For instance, ifthere is a relatively significant (e.g., larger) number of embeddedarrays that contain bits of data relating to a relationship betweenthird property 414 and fourth property 416 that are relatively similarin nature (e.g., a time and/or space nature) to the bit of data 432′ inlocation 540 of the second embedded array 504 (e.g., representative ofthe relationship 432 between third property 414 and fourth property416), and the bit of data 424′ in location 532 of the first embeddedarray 502 (e.g., representative of the relationship 424 between thirdproperty 414 and fourth property 416) is relatively different from thoseother embedded arrays, this can indicate that there is an anomaly 544with regard to the relationship 424 between third property 414 andfourth property 416. The ADMC 126 can employ a trained neural network todetect, determine, identify, infer, or predict anomalies, such asanomaly 544, in embedded arrays comprising bits of data associated withproperties and/or relationships between properties, such as describedherein.

With regard to trained neural networks, the ADMC 126 can employ the AIcomponent 210 to train neural networks of the neural network component212 based at least in part on embedded arrays comprising bits of datarelating to properties and relationships between properties, wherein thetrained neural networks can be utilized to detect, determine, identify,infer, or predict anomalies (e.g., anomaly 544) in embedded arrays(e.g., patterns of bits of data of embedded arrays), or, if desired,detect, determine, identify, infer, or predict similarities in embeddedarrays (e.g., similarities in patterns of bits of data of embeddedarrays). Referring to FIG. 6 (along with FIGS. 1, 2, 3, 4, and 5 ), FIG.6 illustrates a diagram of an example neural network training andanomaly detection process flow 600, in accordance with various aspectsand embodiments of the disclosed subject matter. As indicated atreference numeral 602 of the example neural network training and anomalydetection process flow 600, the ADMC 126, employing the propertycomponent 204, relationship component 206, mapper component 208, AIcomponent 210, and/or another component of or associated with the ADMC126, can generate a desired number of respective embedded arrays,comprising embedded arrays, embedded array₂ up through embeddedarray_(N) (where N can be virtually any desired integer value),associated with respective users (e.g., respective users, and/or useraccounts and/or communication devices associated with respective users),based at least in part on the results of analyzing data associated withusers, wherein the respective embedded arrays can comprise respectivegroups of bits of data that can be representative of respective groupsof properties and respective groups of relationships between propertiesassociated with the respective users, such as more fully describedherein. In some embodiments, the respective embedded arrays can comprisea first subgroup (e.g., first subset) of embedded arrays that cancomprise groups of bits of data relating to groups of properties andgroups of relationships between properties that can be known to beassociated with non-anomalous (e.g., benign or non-fraudulent) behaviorassociated with users, user accounts, and/or communication devices, anda second subgroup (e.g., second subset) of embedded arrays that cancomprise groups of bits of data relating to groups of properties andgroups of relationships between properties that can be known to beassociated with anomalous (e.g., fraudulent, other undesirable, orotherwise anomalous) behavior associated with users, user accounts,and/or communication devices, to facilitate enabling a neural network tobe trained to learn to discriminate, distinguish, determine, or identifybetween non-anomalous behavior and anomalous behavior associated withusers, user accounts, and/or communication devices. As part of theexample neural network training and anomaly detection process flow 600,the AI component 210, employing the training component 214, can enablethe neural network of the neural network component 212 to know whichembedded arrays (e.g., the first subgroup of embedded arrays) relate tonon-anomalous behavior and which embedded arrays (e.g., the secondsubgroup of embedded arrays) relate to anomalous behavior to facilitateenabling the neural network to be trained to learn to discriminate,distinguish, determine, or identify between non-anomalous behavior andanomalous behavior associated with users, user accounts, and/orcommunication devices.

As indicated at reference numeral 604 of the example neural networktraining and anomaly detection process flow 600, the AI component 210can apply (e.g., input) the respective embedded arrays, comprising therespective groups of bits of data, to a neural network 606 to facilitatetraining the neural network. As indicated at reference numeral 608 ofthe example neural network training and anomaly detection process flow600, the AI component 210, employing the training component 214 anddesired AI-based algorithms, models, and/or techniques, can train theneural network 606, based at least in part on the application of therespective groups of bits of data of the respective embedded arrays tothe neural network 606, to generate a trained neural network 610 thatcan desirably (e.g., accurately, suitably, quickly, efficiently,enhancedly, and/or optimally) detect, determine, identify, infer, orpredict anomalies (e.g., anomaly 544) in embedded arrays (e.g.,anomalies in patterns of bits of data of embedded arrays), in accordancewith the defined anomaly detection criteria. Additionally oralternatively, if and as desired, the AI component 210, employing thetraining component 214 and desired AI-based algorithms, models, and/ortechniques, can train another neural network of the neural networkcomponent 212 to generate another trained neural network that candesirably detect, determine, identify, infer, or predict similarities inembedded arrays (e.g., similarities in patterns of bits of data ofembedded arrays), which can be used for other desired purposes, such asmore fully described herein.

With the trained neural network 610 being desirably trained, asindicated at reference numeral 612 of the example neural networktraining and anomaly detection process flow 600, the ADMC 126, employingthe property component 204, relationship component 206, mapper component208, AI component 210, and/or another component of or associated withthe ADMC 126, can generate an embedded array associated with a user(e.g., a user and/or a user account and/or communication device(s)associated with the user), based at least in part on the results ofanalyzing data associated with the user, wherein the embedded array cancomprise a group of bits of data that can be representative ofproperties and relationships between properties associated with theuser, such as more fully described herein. In some embodiments, the ADMC126 can analyze the data and, based at least in part on the results ofanalyzing the data, generate the embedded array associated with the userin real or near real time.

As indicated at reference numeral 614 of the example neural networktraining and anomaly detection process flow 600, the ADMC 126 can apply(e.g., input) the embedded array, comprising the group of bits of data,to the trained neural network 610 (e.g., of the neural network component212) to facilitate desirably (e.g., accurately, suitably, quickly,efficiently, enhancedly, and/or optimally) determining whether there isan anomaly (e.g., abnormality, irregularity) in the bits of data of theembedded array (e.g., an anomaly in the pattern of the bits of data ofthe embedded array), for example, relative to the first subgroup ofembedded arrays (e.g., as compared to the patterns of the bits of dataof the embedded arrays of the first subgroup of embedded arrays)associated with non-anomalous behavior associated with users, useraccounts, and/or communication devices. The AI component 210 and thetrained neural network 610 can utilize the pattern component 216 todetermine, identify, recognize, or infer a pattern(s) in the embeddedarray and respective patterns of the respective embedded arrays thatwere utilized to train the trained neural network 610 to facilitatedetermining, identifying, recognizing, or inferring any difference(s)between the pattern(s) in the embedded array (e.g., pattern(s) in thebits of data of the embedded array) and the respective patterns of therespective embedded arrays (e.g., respective patterns in the respectivebits of data of the respective embedded arrays used for training of thetrained neural network 610). In some embodiments, the trained neuralnetwork 610 can analyze the embedded array and, based at least in parton the results of analyzing the embedded array, can determine whetherthere is an anomaly in the embedded array in real or near real time.

In some embodiments, even after training a neural network to create atrained neural network (e.g., trained neural network 610), the AIcomponent 210 can continue to train the trained neural network byapplying additional embedded arrays comprising bits of data (e.g., andnew or additional data is obtained) to refine or improve the performanceof the trained neural network with regard to rendering detections,determinations, or inferences (e.g., detections, determinations, orinferences of anomalies in data patterns in bits of data of an embeddedarrays). In certain embodiments, additionally or alternatively, the AIcomponent 210 can receive feedback information from entities (e.g.,representatives or other personnel of entities), wherein the feedbackinformation can indicate whether particular detections, determinations,or inferences (e.g., anomaly detections, determinations, or inferences,or other detections, determinations, or inferences) made by the trainedneural network are accurate (e.g., accurate or correct) or not. The AIcomponent 210 can update the trained neural network based at least inpart on the feedback information or input information relating to thefeedback information to facilitate refining or improving the performanceof the trained neural network with regard to rendering detections,determinations, or inferences (e.g., anomaly detections, determinations,or inferences, or other detections, determinations, or inferences).

To illustrate some examples of anomaly detection, with further referenceto the first embedded array 502 and second embedded array 504, thesecond embedded array 504 can represent a normal set of propertiesassociated with a user (e.g., user B 308), and the first embedded array502 associated with user A 304 can be under analysis by the trainedneural network 610. Based at least in part on the results of analyzing(e.g., performing an AI-based analysis) on the bits of data of the firstembedded array 502, the trained neural network 610 can detect,determine, identify, or infer that there is an anomaly 544 with regardto the bit of data 424′ in location 532 of the first embedded array 502,wherein the bit of data 424′ can be representative of the relationship424 between third property 414 and fourth property 416, such as morefully described herein. For reasons of brevity and clarity, the sameembedded arrays 502 and 504 are being used with regard to differentexample scenarios. It is to be appreciated and understood that, underdifferent scenarios, the bit locations of the bits of data in anembedded array, the number of bits in the embedded array, the number ofproperties and the number of relationships associated with the bits ofdata in the embedded array, and/or other characteristics associated withthe embedded array can vary depending on the data associated with thescenario and the events and relationships associated with the scenario,and also, the space-time representation associated with the scenario canvary depending on the data associated with the scenario and the eventsand relationships associated with the scenario.

As an example, the fourth property 416 can represent or relate to theadding of a new user as an authorized user or an ostensibly “authorized”user on the user account associated with a user at a first time, and thethird property 414 can represent or relate to a request or order for anupgrade of a communication device (e.g., smart phone) associated withthe user account by the newly authorized user or ostensibly “authorized”user. The event of adding a new user as an authorized user, in and ofitself (e.g., when considered in isolation), usually can be a benign(e.g., non-anomalous) event. The event of requesting or ordering anupgrade of a communication device, in and of itself (e.g., whenconsidered in isolation), also typically can be a benign (e.g.,non-anomalous) event.

With regard to the second embedded array 504 (which can represent anormal case that can be used to facilitate training the trained neuralnetwork 610), the relationship 432′ between third property 414 andfourth property 416 can relate to the length of time between theoccurrence of the event (e.g., adding of an new user as an authorizeduser) associated with the fourth property 416 and the other event (e.g.,the newly authorized user requesting or ordering an upgrade of acommunication device under the user account associated with the user)associated with the third property 414, wherein the relationship 432′can indicate that a relatively longer amount of time (e.g., 17 hours)elapsed between the time the event associated with the fourth property416 occurred and the time the other event associated with the thirdproperty 414 occurred. This relatively longer amount of time betweenthose events can be determined to be relatively normal and notassociated with fraudulent or otherwise abnormal or undesirable behavior(e.g., based on a number of instances and associated embedded arraysindicating such relatively longer amount of time between those events isnot associated with, correlated with, or indicative of fraudulent,abnormal, or otherwise undesirable behavior).

In contrast, with regard to the first embedded array 502, therelationship 424′ between third property 414 and fourth property 416 canindicate that a relatively short amount of time (e.g., 28 minutes)elapsed between the time the event associated with the fourth property416 occurred and the time the other event associated with the thirdproperty 414 occurred. This relatively short amount of time betweenadding the new authorized user to the user account associated with theuser and the newly authorized user requesting or ordering an upgrade ofa communication device under the user account associated with the usercan be indicative of fraud by an unauthorized entity 122 and/or anassociated entity (e.g., the newly “authorized” user added to the useraccount), as it can be determined that an unauthorized entity (e.g.,122) or an associated entity can be more likely to wait a relativelyshort amount of time between adding (e.g., fraudulently or improperlyadding) a new “authorized” user to a user account associated with a userand having the newly (fraudulently or improperly) “authorized” user orthe unauthorized entity (e.g., 122) requesting or ordering an upgrade ofa communication device under the user account associated with the user.Based at least in part on the trained neural network 610 determiningthat the amount of time (e.g., 28 minutes) between the occurrence of theevent associated with the fourth property 416 and the occurrence of theother event associated with the third property 414 is relatively andabnormally short, the trained neural network 610 can detect, determine,identify, or infer that the relationship 424′ between third property 414and fourth property 416 is an anomaly (e.g., anomaly 544) and/orindicates fraudulent, or at least potentially fraudulent, activity.

As another example, the fourth property 416 can represent or relate to alocation of a communication device (e.g., smart phone) of a userassociated with a user account at a particular time, and the thirdproperty 414 can represent or relate to someone calling the entity 118(e.g., a representative associated with the entity 118 that providescommunication services associated with the user account of a user) andrequesting to change (e.g., swap) the SIM card associated with the useraccount of the user (e.g., change the SIM card associated with thatcommunication device by deactivating the SIM card associated with thatcommunication device and activating a SIM card on another communicationdevice) at that same particular time (or alternatively, someone callingthe entity 118 to request to add a line to the user account of theuser). The event of requesting to change the SIM card associated with auser account of the user (or alternatively, the event of requesting toadd a line to the user account of the user), in and of itself (e.g.,when considered in isolation), usually can be a benign event. In ascenario involving fraudulent activity, the request to change the SIMcard can involve, for example, a request by an unauthorized entity 122(who may be representing as an authorized entity and may not be known tobe an unauthorized entity with regard to a user account) to deactivate aSIM card associated with that communication device associated with theuser account and activate a SIM card on another communication device inconnection with the user account.

With regard to the second embedded array 504, the relationship 432′between third property 414 and fourth property 416 can relate to thelocation of the communication device of the user associated with thefourth property 416 and the location of the other event (e.g.,requesting to change the SIM card (or alternatively, requesting to add aline to the user account of the user)) associated with the thirdproperty 414, wherein the relationship 432′ can indicate that thelocation of the communication device of the user associated with thefourth property 416 is the same, or substantially the same, as thelocation where the phone call is being made to request a change to theSIM card associated with the user account of the user (or alternatively,the location where the phone call is being made to request to add a lineto the user account of the user), which can be associated with the thirdproperty 414. The location of the communication device being the same orsubstantially the same as the location from which the phone callrequesting the change to the SIM card associated with the user accountof the user (or alternatively, the location from which the phone callrequesting to add a line to the user account of the user) can indicatethat the events appear to be relatively normal and not associated withfraudulent or otherwise abnormal or undesirable behavior (e.g., based ona number of instances and associated embedded arrays indicating suchevents occurring at same or substantially same location (e.g., at thesame time) is not associated with, correlated with, or indicative offraudulent, abnormal, or otherwise undesirable behavior).

In contrast, with regard to the first embedded array 502, therelationship 424′ between third property 414 and fourth property 416 canindicate that the location of the communication device associated withthe user and user account, associated with the fourth property 416, isrelatively far away from the location of the other event (e.g., thephone call to request a change to the SIM card associated with the useraccount (or alternatively the phone call to request to add a line to theuser account of the user) associated with the third property 414. Thisrelatively large distance between the location of the communicationdevice associated with the user account and the user and the locationfrom which the phone call is being made to request a change to the SIMcard associated with the user account of the user (or alternatively, thelocation from which the phone call is being made to request to add aline to the user account of the user) can be indicative of fraud by anunauthorized entity 122, as it can be determined (e.g., by the trainedneural network 610) that it can be unlikely and/or unusual that the user(e.g., authorized user) associated with the communication device and theuser account would be calling to request a change to the SIM cardassociated with the user account (or alternatively, calling to requestto add a line to the user account of the user) while at one location,while, at the same time, the communication device of the user is locatedrelatively far away from the location of the phone call. Based at leastin part on the trained neural network 610 determining that the locationof the communication device associated with the user account and user,associated with the fourth property 416, and the location of the otherevent (e.g., phone call to change the SIM card associated with the useraccount (or alternatively, phone call to request to add a line to theuser account) associated with the third property 414 are relatively faraway from each other, the trained neural network 610 can detect,determine, identify, or infer that the relationship 424′ between thirdproperty 414 and fourth property 416 is an anomaly (e.g., anomaly 544)and/or indicates fraudulent, or at least potentially fraudulent,activity.

As another example, the fourth property 416 can represent or relate tosomeone, representing as being the user associated with the useraccount, attempting to add a new user as an authorized user or anostensibly “authorized” user on the user account associated with a userat a first time, and the third property 414 can represent or relate to aphone call being made on a communication device (e.g., smart phone) ofthe user associated with the user account. The event of adding a newuser as an authorized user, in and of itself (e.g., when considered inisolation), usually can be a benign (e.g., non-anomalous) event. Theevent of making a phone call on a communication device, in and of itself(e.g., when considered in isolation), also typically can be a benign(e.g., non-anomalous) event.

With regard to the second embedded array 504, the relationship 432′between third property 414 and fourth property 416 can relate to thelength of time between the occurrence of the event (e.g., adding of annew user as an authorized user) associated with the fourth property 416and the other event (e.g., making the phone call) associated with thethird property 414, wherein the relationship 432′ can indicate that arelatively longer amount of time (e.g., 5 hours) elapsed between thetime the event (e.g., adding of an new user as an authorized user)associated with the fourth property 416 occurred and the time the otherevent (e.g., making the phone call) associated with the third property414 occurred. This relatively longer amount of time between those eventscan be determined to be relatively normal and not associated withfraudulent or otherwise abnormal or undesirable behavior (e.g., based ona number of instances and associated embedded arrays indicating suchrelatively longer amount of time between those events is not associatedwith, correlated with, or indicative of fraudulent, abnormal, orotherwise undesirable behavior).

In contrast, with regard to the first embedded array 502, therelationship 424′ between third property 414 and fourth property 416 canindicate that the time of the event associated with the fourth property416 (e.g., adding a new authorized user to the user account) occurredand the time the other event (e.g., making the phone call) associatedwith the third property 414 occurred overlap each other. Suchoverlapping of the time of adding the new authorized user to the useraccount associated with the user while at the same time a phone is beingmade on the communication device of the user associated with the useraccount can be indicative of fraud by an unauthorized entity 122, as itcan be determined (e.g., by the trained neural network 610) that theuser associated with the account is not likely to be making a phone callat the same time the user is attempting to add an authorized user to theuser account, and thus, it is likely that the act of attempting to addan authorized user to the user account can be, or at least potentiallycan be, fraudulent activity by the unauthorized entity 122. Based atleast in part on the trained neural network 610 determining that thetimes of the occurrence of the event associated with the fourth property416 and the occurrence of the other event associated with the thirdproperty 414 overlap each other, the trained neural network 610 candetect, determine, identify, or infer that the relationship 424′ betweenthird property 414 and fourth property 416 is an anomaly (e.g., anomaly544) and/or indicates fraudulent, or at least potentially fraudulent,activity by the unauthorized entity 122.

Another example can relate to someone accessing an online store of awebsite of an entity 118 to purchase a communication device (or otherproduct or service) from the online store under the user accountassociated with a user (e.g., user 112). In this example scenario, thefourth property 416 can represent or relate to someone interacting withor accessing web pages of a website of an online store associated withthe entity 118 at a first time, and the third property 414 can representor relate to that someone purchasing a communication device (e.g., smartphone) via a web page of the online store website at a second time. Theevents of interacting with or accessing web pages of the website of theonline store associated with the entity 118, in and of themselves (e.g.,when considered in isolation), often can be a non-anomalous event.

With regard to the second embedded array 504 (which can represent anormal case that can be used to facilitate training the trained neuralnetwork 610), the relationship 432′ between third property 414 andfourth property 416 can relate to the length of time between theoccurrence of the event(s) (e.g., first interacting with or accessingweb pages of the online store website at the first time) associated withthe fourth property 416 and the other event (e.g., the purchase of acommunication device via a web page (e.g., online store checkout page)of the online store website at the second time) associated with thethird property 414 and/or can relate to the content of the web pagesaccessed or interacted with by the user and/or can relate to the type ofinteraction with the web pages (e.g., user clicking on various buttonsassociated with various options relating to offers for communicationdevices, or clicking on buttons to view a communication device indifferent colors), wherein the relationship 432′ can indicate that arelatively longer amount of time (e.g., 20 minutes) elapsed between thetime the event(s) associated with the fourth property 416 occurred andthe time the other event associated with the third property 414occurred. This relatively longer amount of time between those events canbe determined to be relatively normal and not associated with fraudulentor other undesirable behavior, such as fraudulent activity involving anunauthorized entity 122 fraudulently and illegally purchasing acommunication device under the user account associated with the user(e.g., user 112) (e.g., based on a number of instances and associatedembedded arrays indicating such relatively longer amount of time betweenthose events is not associated with, correlated with, or indicative offraudulent or other undesirable behavior).

In contrast, with regard to the first embedded array 502, therelationship 424′ between third property 414 and fourth property 416 canindicate that a relatively short amount of time (e.g., less than 2minutes) elapsed between the time the event associated with the fourthproperty 416 occurred and the time the other event (e.g., the purchase,or initiation of the purchase, of an expensive communication deviceunder the user account associated with the user) associated with thethird property 414 occurred. This relatively short amount of timebetween someone (e.g., unauthorized entity 122) first accessing andinteracting with the web pages of the online store website and thatsomeone selecting and purchasing (or initiating the purchase of) anexpensive (e.g., the most expensive) communication device via a checkoutweb page (e.g., online store checkout page) of the online store websitewithout that someone taking time to browse through various types ofcommunication devices and/or various types of options for acommunication device can be indicative of fraudulent activity, as thatsomeone quickly selected and initiated the purchase of the expensivecommunication device without web page interactions indicating that thissomeone even bothered to consider other types of communication devicesor available options (e.g., different colors or different memory storagesizes) for a communication device. Based at least in part on the trainedneural network 610 determining that the amount of time (e.g., less than2 minutes) between the occurrence of the event associated with thefourth property 416 and the occurrence of the other event associatedwith the third property 414 is relatively and abnormally short and/ordetermining that this someone (e.g., unauthorized entity 122) primarilyonly interacted with a web page offering the expensive communicationdevice and the checkout web page to initiate purchase of the expensivecommunication device, the trained neural network 610 can detect,determine, identify, or infer that the relationship 424′ between thirdproperty 414 and fourth property 416 is an anomaly (e.g., anomaly 544)and/or indicates fraudulent, or at least potentially fraudulent,activity associated with the user account of the user. In such case, theADMC 126 and/or the entity 118 (e.g., representative, whether a humanuser or a VA, associated with the entity 118) can take a response actionto prevent or mitigate the fraudulent purchase of the expensivecommunication device (e.g., by preventing the order for the expensivecommunication device from being completed) and/or can take action toprevent future fraudulent activity associated with the user account ofthe user and/or the someone (e.g., unauthorized entity 122) andassociated communication device (e.g., 124).

Still another example can relate to churn activity by a user (e.g., user112) associated with the user account. In this example scenario, thefourth property 416 can represent or relate to the user associated withthe user account interacting with or accessing web pages of a website ofan online store associated with the entity 118 at a first time, and thethird property 414 can represent or relate to the user ending the user'sinteracting with or accessing web pages of the website at a second time.The event of interacting with or accessing web pages of the website ofthe online store associated with the entity 118, in and of itself (e.g.,when considered in isolation), often can be a non-anomalous event.

With regard to the second embedded array 504 (which can represent anormal case that can be used to facilitate training the trained neuralnetwork 610), the relationship 432′ between third property 414 andfourth property 416 can relate to the length of time between theoccurrence of the event (e.g., first interacting with or accessing webpages of the online store website at the first time) associated with thefourth property 416 and the other event (e.g., the ending of theinteraction with or accessing of web pages of the online store websiteat the second time) associated with the third property 414 and/or canrelate to the content of the web pages accessed or interacted with bythe user and/or can relate to the type of interaction with the web pages(e.g., user clicking on various buttons associated with various optionsrelating to offers for products or services), wherein the relationship432′ can indicate that a relatively longer amount of time (e.g., 15minutes) elapsed between the time the event associated with the fourthproperty 416 occurred and the time the other event associated with thethird property 414 occurred. This relatively longer amount of timebetween those events can be determined to be relatively normal and notassociated with undesirable behavior, such as undesirable churn behaviorassociated with a user (e.g., based on a number of instances andassociated embedded arrays indicating such relatively longer amount oftime between those events is not associated with, correlated with, orindicative of undesirable behavior).

In contrast, with regard to the first embedded array 502, therelationship 424′ between third property 414 and fourth property 416 canindicate that a relatively short amount of time (e.g., less than 2minutes) elapsed between the time the event associated with the fourthproperty 416 occurred and the time the other event associated with thethird property 414 occurred. This relatively short amount of timebetween first accessing and interacting with the web pages of the onlinestore website and ending such accessing and interacting with the webpages and/or the user (e.g., user 112) primarily only interacting withweb pages presenting offers and/or showing costs associated with certainproducts and services can be indicative of undesirable churn activityassociated with the user associated with the user account, as it can bedetermined that the user may be more likely to be considering ending theuser's subscription with the entity 118 and starting a subscription withanother entity (e.g., another entity that offers the same or similarproduct(s) and/or service(s)) if the user spent a relatively shortamount of time (e.g., less than 2 minutes) accessing and interactingwith the web pages of the online store website of the entity 118 and/orthe user primarily only interacted with (e.g., viewed) web pagespresenting offers and/or showing costs associated with certain productsand services (e.g., the user only quickly viewed some offers and costsfor a certain product(s) or service(s) on the online store website ofthe entity 118 and then left the website). Based at least in part on thetrained neural network 610 determining that the amount of time (e.g.,less than 2 minutes) between the occurrence of the event associated withthe fourth property 416 and the occurrence of the other event associatedwith the third property 414 is relatively and abnormally short and/ordetermining that the user primarily only interacted with web pagespresenting offers and/or showing costs associated with certain productsand services, the trained neural network 610 can detect, determine,identify, or infer that the relationship 424′ between third property 414and fourth property 416 is an anomaly (e.g., anomaly 544) and/orindicates churn, or at least potential churn, activity associated withthe user associated with the user account. In such case, the entity 118(e.g., representative, whether a human user or a VA, associated with theentity 118) can or may present, or at least considering presenting, anoffer for a product or service to the user (e.g., 112) to attempt tokeep the user from ending the user's subscription with the entity 118.

As yet another example, the trained neural network 610 can be utilizedto facilitate detecting attacks, such as distributed denial of service(DDoS) attacks, against the communication network 102 (e.g., against thenetwork equipment 104 of the communication network 102). For instance,when communication by a communication device is desired, thecommunication device typically can connect to a base station and remainconnected to the base station for a relatively significant amount oftime, as opposed to connecting to the base station, then relativelyquickly disconnecting from the base station, and, shortly thereafter,connecting again to the base station. To do such a DDoS attack,typically, there can be a relatively large number of communicationdevices that can be acting in an aggressive or malicious manner againstthe communication network 102, for instance, by connecting to a basestation, quickly disconnecting from the base station, quickly connectingagain to the base station, quickly disconnecting from the base stationagain, and so on. If, with regard to a communication device (e.g.,communication device 124), based at least in part on an AI-basedanalysis of bits of data of an embedded array (e.g., first embeddedarray 502) associated with the communication device, the trained neuralnetwork 610 detects that the amount of time (e.g., the relationship 424′(e.g., the bit of data representing the relationship) in the bits ofdata that can relate to or indicate the amount of time) between an eventassociated with a property (e.g., fourth property 416) and another eventassociated with another property (e.g., third property 414) isrelatively short (and/or such events and relationship are repeating forthat communication device over relatively short amounts of time, and/orsimilar events and relationships are occurring with regard to arelatively large number of other communication devices based on anAI-based analysis of embedded arrays associated with those othercommunication devices), the trained neural network 610 can detect,determine, or infer that there can be an anomaly associated with thatcommunication device (and/or the other communication devices) withregard to the events of connecting and disconnecting from the basestation in a relatively quick manner.

With further regard to detected anomalies 616, if, based at least inpart on the analysis (e.g., AI-based analysis) of the bits of data ofthe embedded array by the trained neural network 610, the trained neuralnetwork 610 detects, determines, identifies, infers, or predicts thatthere is an anomaly 616 associated with the bits of data, andaccordingly, associated with the user (e.g., the user, and/or the useraccount and/or communication device(s) associated with the user), thetrained neural network 610 can present (e.g., communicate) anomalyinformation relating to the anomaly 616, which can indicate the propertyand/or relationship between properties that are associated with theanomaly 616 (e.g., the property and/or relationship between propertiesthat triggered the trained neural network 610 to detect the anomaly 616)and/or what is the anomalous behavior or attribute associated with theproperty and/or relationship between properties that caused the trainedneural network 610 to detect the anomaly 616, in accordance with thedefined anomaly detection criteria. The anomaly detector component 218can receive the anomaly information relating to the anomaly 616 from thetrained neural network 610. The anomaly detector component 218 cananalyze and/or interpret the anomaly information relating to the anomaly616, and, based at least in part on the results of such analysis and/orinterpretation, the anomaly detector component 218 can detect, identify,or determine what the anomaly 616 is and/or relevant and/or contextualinformation relating to the anomaly 616. For instance, the anomalydetector component 218 can determine what event(s), interaction(s),activity(ies), and/or communication(s) is anomalous (e.g., abnormal,irregular, and/or improper) and/or why it is anomalous, whether there isfraud or potential fraud associated with the anomaly 616, what productor service is the subject of the fraud or potential fraud, identifyinginformation (e.g., name, address, phone number, email address, SIMinformation, or other identifying information) associated with theanyone (e.g., unauthorized entity 122) who is associated with theanomaly 616, identifying information (e.g., device identifier, IPaddress, device location information, or other identifying information)associated with any communication device (e.g., communication device124) associated with the anomaly 616, and/or other desired informationrelating to the anomaly 616.

The notification component 220 can generate and present (e.g., via theinterface component 202) a notification message (e.g., an alarm or alertmessage or signal) relating to the anomaly 616. In some embodiments, thenotification message can comprise information indicating that theanomaly 616 has been detected and other information relating to theanomaly 616 (e.g., information that can indicate what the anomaly 616 isand/or other relevant and/or contextual information relating to theanomaly 616). In other embodiments, the notification message cancomprise an anomalous condition notification indicator that can providea user (e.g., representative associated with the entity 118, or userassociated with the user account), device (e.g., communication device120), or component (e.g., response component 222) with notification thatthe anomaly 616 has been detected. The notification component 220 cancommunicate the notification message to the user (e.g., representativeassociated with the entity 118, or user associated with the useraccount), device (e.g., communication device 120), and/or component(e.g., response component 222).

In some embodiments, the ADMC 126 can employ the response component 222to have the response component 222 perform (e.g., automatically ordynamically perform) a desired response action to respond to or mitigatethe anomalous behavior or actions (e.g., behavior or actions of orassociated with the unauthorized entity 122 and/or associatedcommunication device 124) associated with the anomaly 616. For instance,in response to the detected anomaly 616, the response component 222 canperform a response action to block or prevent the unauthorized entity122 and/or associated communication device 124 from making a fraudulentpurchase or upgrade of a product or service (e.g., under the useraccount of the user (e.g., user 112), block or prevent the unauthorizedentity 122 and/or associated communication device 124 from performing afraudulent swapping of a SIM card, block or prevent the unauthorizedentity 122 and/or associated communication device 124 from fraudulentlyadding a line (e.g., for the unauthorized entity 122 and/or anassociated communication device) to a user account associated with auser (e.g., user 112), block or prevent robocalls or spam callsassociated with the unauthorized entity 122 and/or associatedcommunication device 124, block or prevent the unauthorized entity 122and/or associated communication device 124 from successfully engaging inother fraudulent activity, initiate undoing or mitigation of harm (e.g.,financial harm or costs, or other harm) resulting from fraudulentactivity associated with the detected anomaly 616, and/or block,prevent, or mitigate any other undesired or improper activity associatedwith the detected anomaly 616.

While the ADMC 126 can create a trained neural network to detectanomalies in embedded arrays, the ADMC 126 also can create and trainneural networks for other desired purposes, such as, for example, sales,marketing, and/or to determine whether certain events and/or anomalieshave been overlooked (e.g., missed). For instance, the AI component 210can train a neural network to detect, determine, identify, recognize, orinfer similarities between data patterns (e.g., patterns of bits of datain embedded arrays) based at least in part on a group of embeddedarrays, comprising bits of data, applied to the neural network, whereinthe AI component 210 can train the neural network to facilitate steeringor configuring the neural network to learn to detect, determine,identify, recognize, or infer similarities between data patterns. Forexample, the AI component 210 can apply embedded arrays comprising bitsof data relating to respective sales and/or marketing attributes (e.g.,characteristics) associated with respective users to the neural networkto train the neural network to detect, determine, identify, recognize,or infer similarities between data patterns with regard to sales and/ormarketing attributes to generate a trained neural network.

With a trained neural network that is trained to determine, identify,recognize, or infer similarities between data patterns with regard tosales and/or marketing attributes, the ADMC 126 can apply an embeddedarray, comprising bits of data, that can be associated with a user(e.g., user 112). The trained neural network can detect, determine,identify, recognize, or infer whether there are any similarities betweenthe bits of data of the embedded array associated with the user andother data patterns associated with the trained neural network. Based atleast in part on the AI-based analysis by the trained neural network, ifthe trained neural network does not detect any similarities, the trainedneural network can indicate that no similarities were detected. If,instead, based at least in part on the AI-based analysis by the trainedneural network, the trained neural network does detect, determine,identify, recognize, or infer one or more similarities in the bits ofdata relative to other data patterns associated with (e.g., known orrecognized by) the trained neural network, the trained neural networkcan indicate what sales and/or marketing attributes associated with theembedded array associated with the user are recognized as being same asor similar to other sales and/or marketing attributes associated withother users and/or can indicate what products, services, offers, deals,or sales can be presented and/or what marketing techniques can beutilized (e.g., may be effective) to facilitate enticing the user topurchase a product and/or service. For example, if the AI-based analysisby the trained neural network indicates that users with similarattributes to the user have purchased or displayed an interest inpurchasing a particular communication device (e.g., a particular smartphone) as compared to other types of communication devices, the trainedneural network can output information that can indicate there is somesimilarity between this user and other users with regard tocommunication devices and this user likely may be interested in an offerto purchase the particular communication device.

In other embodiments, the AI component 210 can train a neural network todetect, determine, identify, recognize, or infer similarities withregard to a data pattern (e.g., bits of data of an embedded array)associated with a detected anomaly (e.g., an anomaly detected by anothertrained neural network, such as described herein) and other datapatterns (e.g., other bits of data associated with other embeddedarrays) associated with previous events and relationships to facilitatedetermining whether there were some anomalies relating to anomalousand/or fraudulent events, properties, or relationships that may havebeen overlooked. For instance, if a first trained neural network (e.g.,trained neural network that is trained to detect anomalies) detects ananomaly associated with bits of data of an embedded array associatedwith a user, the AI component 210 can utilize a second trained neuralnetwork (e.g., trained neural network that is trained to detectsimilarities between data patterns) to analyze previous respectiveembedded arrays comprising respective bits of data, and/or its trainingand knowledge of previous data patterns (e.g., previous embedded arraysutilized to train the second trained neural network) to determinewhether there is a previous embedded array and associated events andrelationships that can contain a same or similar anomaly (e.g., anomalyassociated with certain events, properties, and/or relationship(s)) aswhat was detected by the first trained neural network. If the secondtrained neural network detects, determines, identifies, recognizes, orinfers that there is or are one or more previous embedded arrays andassociated events and relationships that can contain a same or similaranomaly as what was detected by the first trained neural network, thesecond trained neural network can present information indicating thatone or more previous embedded arrays and associated events andrelationships that is or are same as or similar to the detected anomalyhave been detected. In some embodiments, the second trained neuralnetwork can employ a k-nearest neighbor search and/or k-nearest neighboralgorithm to facilitate determining whether there are any previousembedded arrays (e.g., any previous bits of data of previous embeddedarrays) that are similar enough to the bits of data of the embeddedarray of the detected anomaly to be identified as having anomalies. TheADMC 126 can utilize such information relating to detecting one or moreanomalies relating to one or more previous embedded arrays andassociated events and relationships to determine a desired responseaction (e.g., response or mitigation action) to take in response todetecting such one or more anomalies, such as described herein.

It is to be appreciated and understood that, while some of embodimentsand aspects of the disclosed subject matter described herein relate todetection of anomalies, which can or may be fraudulent or otherundesired activity, associated with user accounts of users, thedisclosed subject matter is not so limited, and the disclosed subjectmatter can utilize the disclosed techniques relating to generatingembedded arrays comprising bits of data representative of properties andrelationships between properties, applying embedded arrays to a neuralnetwork to train the neural network, and using the trained neuralnetwork to detect or infer anomalies in embedded arrays analyzed by thetrained neural network for virtually any desired purpose where it can bedesired to detect anomalies in data, events, activities, interactions,or communications associated with people or entities.

With further regard to FIG. 2 , the operations manager component 224 cancontrol (e.g., manage) operations associated with the ADMC 126. Forexample, the operations manager component 224 can facilitate generatinginstructions to have components of the ADMC 126 perform operations, andcan communicate respective instructions to respective components (e.g.,interface component 202, property component 204, relationship component206, mapper component 208, AI component 210, anomaly detector component218, notification component 220, response component 222, processorcomponent 226, and data store 228) of the ADMC 126 to facilitateperformance of operations by the respective components of the ADMC 126based at least in part on the instructions, in accordance with thedefined anomaly detection management criteria and anomaly detectionmanagement algorithms (e.g., mapping algorithms, pattern determinationor inference algorithms, anomaly detection algorithms, AI, ML, or neuralnetwork algorithms, AI-based training algorithms, predictive algorithms,clustering algorithms, or other algorithms, as disclosed, defined,recited, or indicated herein by the methods, systems, and techniquesdescribed herein). The operations manager component 224 also canfacilitate controlling data flow between the respective components ofthe ADMC 126 and controlling data flow between the ADMC 126 and anothercomponent(s) or device(s) (e.g., a communication device, a base stationor other network equipment of the communication network, resources, datasources, applications, or other type of component or device) associatedwith (e.g., connected to) the ADMC 126.

The processor component 226 can work in conjunction with the othercomponents (e.g., interface component 202, property component 204,relationship component 206, mapper component 208, AI component 210,anomaly detector component 218, notification component 220, responsecomponent 222, operations manager component 224, and data store 228) tofacilitate performing the various functions of the ADMC 126. Theprocessor component 226 can employ one or more processors,microprocessors, or controllers that can process data, such asinformation relating to users, entities, events, interactions,activities, communications, properties, relationships betweenproperties, embedded arrays, embedding, mapping or coding of data,communication devices, network measurements, network data traffic,applications, patterns, anomalies associated with patterns (e.g.,anomalies associated with bits of data, users, entities, events,interactions, activities, communications, properties, or relationships),metadata, messages, notifications, responsive or mitigation actions,parameters, threshold values, traffic flows, policies, defined anomalydetection management criteria, algorithms (e.g., mapping algorithms,pattern determination or inference algorithms, anomaly detectionalgorithms, AI, ML, deep learning, or neural network algorithms,AI-based training algorithms, predictive algorithms, clusteringalgorithms, or other algorithms, as disclosed, defined, recited, orindicated herein by the methods, systems, and techniques describedherein), protocols, interfaces, tools, and/or other information, tofacilitate operation of the ADMC 126, as more fully disclosed herein,and control data flow between the ADMC 126 and other components (e.g., acommunication device, a base station or other network equipment of thecommunication network, resources, data sources, applications, or othertype of component or device) associated with the ADMC 126.

The data store 228 can store data structures (e.g., user data,metadata), code structure(s) (e.g., modules, objects, hashes, classes,procedures) or instructions, information relating to users, entities,events, interactions, activities, communications, properties,relationships between properties, embedded arrays, embedding, mapping orcoding of data, communication devices, network measurements, networkdata traffic, applications, patterns, anomalies associated with patterns(e.g., anomalies associated with bits of data, users, entities, events,interactions, activities, communications, properties, or relationships),metadata, messages, notifications, responsive or mitigation actions,parameters, threshold values, traffic flows, policies, defined anomalydetection management criteria, algorithms (e.g., mapping algorithms,pattern determination or inference algorithms, anomaly detectionalgorithms, AI, ML, deep learning, or neural network algorithms,AI-based training algorithms, predictive algorithms, clusteringalgorithms, or other algorithms, as disclosed, defined, recited, orindicated herein by the methods, systems, and techniques describedherein), protocols, interfaces, tools, and/or other information, tofacilitate controlling operations associated with the ADMC 126. In anaspect, the processor component 226 can be functionally coupled (e.g.,through a memory bus) to the data store 228 in order to store andretrieve information desired to operate and/or confer functionality, atleast in part, to the interface component 202, property component 204,relationship component 206, mapper component 208, AI component 210,anomaly detector component 218, notification component 220, responsecomponent 222, operations manager component 224, processor component226, data store 228, and/or other component, and/or substantially anyother operational aspects of the ADMC 126.

With further regard to the AI component 210, the AI component 210 canperform an AI and/or ML analysis on data, such as data associated withusers (e.g., data associated with user accounts of users), dataassociated with events, interactions, activities, or communicationsassociated with users or entities, network measurement data,network-related data, communication device-related data, external data,and/or other desired data, such as more fully described herein. Inconnection with or as part of such an AI or ML analysis, the AIcomponent 210 can employ, apply, build (e.g., construct or create),and/or import, AI, ML, and/or deep learning techniques and algorithms,AI, ML, and/or deep learning models (e.g., trained models), neuralnetworks (e.g., trained neural networks), and/or graph mining to renderand/or generate predictions, inferences, calculations, prognostications,estimates, derivations, forecasts, detections, and/or computations thatcan facilitate training neural networks to enable trained neuralnetworks to desirably (e.g., accurately, quickly, efficiently,enhancedly, and/or optimally) detect anomalies (e.g., fraudulentactivity or other undesired anomalous activity) in embedded arrays(e.g., anomalies in bits of data in embedded arrays) relating to events,interactions, activities, and/or communications associated with users orentities, training neural networks to enable trained neural networks todesirably detect similarities in patterns of data relating to events,interactions, activities, and/or communications associated with users orentities, and/or automating one or more functions or features of thedisclosed subject matter.

The AI component 210 can employ various AI-based or ML-based schemes forcarrying out various embodiments/examples disclosed herein. In order toprovide for or aid in the numerous determinations (e.g., determine,ascertain, infer, calculate, predict, prognose, estimate, derive,forecast, detect, compute) described herein with regard to the disclosedsubject matter, the AI component 210 can examine the entirety or asubset of the data (e.g., data associated with users, data associatedwith events, interactions, activities, or communications associated withusers or entities, network measurement data, network-related data,communication device-related data, external data, and/or other desireddata) to which it is granted access and can provide for reasoning aboutor determine states of the system and/or environment from a set ofobservations as captured via events and/or data. Determinations can beemployed to identify a specific context or action, or can generate aprobability distribution over states, for example. The determinationscan be probabilistic; that is, the computation of a probabilitydistribution over states of interest based on a consideration of dataand events. Determinations can also refer to techniques employed forcomposing higher-level events from a set of events and/or data.

Such determinations can result in the construction of new events oractions from a set of observed events and/or stored event data, whetheror not the events are correlated in close temporal proximity, andwhether the events and data come from one or several event and datasources. Components disclosed herein can employ various classification(explicitly trained (e.g., via training data) as well as implicitlytrained (e.g., via observing behavior, preferences, historicalinformation, receiving extrinsic information, and so on)) schemes and/orsystems (e.g., support vector machines, neural networks, expert systems,Bayesian belief networks, fuzzy logic, data fusion engines, and so on)in connection with performing automatic and/or determined action inconnection with the claimed subject matter. Thus, classification schemesand/or systems can be used to automatically learn and perform a numberof functions, actions, and/or determinations.

A classifier can map an input attribute vector, z=(z1, z2, z3, z4, . . ., zn), to a confidence that the input belongs to a class, as byf(z)=confidence(class). Such classification can employ a probabilisticand/or statistical-based analysis (e.g., factoring into the analysisutilities and costs) to determinate an action to be automaticallyperformed. A support vector machine (SVM) can be an example of aclassifier that can be employed. The SVM operates by finding ahyper-surface in the space of possible inputs, where the hyper-surfaceattempts to split the triggering criteria from the non-triggeringevents. Intuitively, this makes the classification correct for testingdata that is near, but not identical to training data. Other directedand undirected model classification approaches include, e.g., naïveBayes, B ayesian networks, decision trees, neural networks, fuzzy logicmodels, and/or probabilistic classification models providing differentpatterns of independence, any of which can be employed. Classificationas used herein also is inclusive of statistical regression that isutilized to develop models of priority.

The systems and/or devices, including the aforementioned systems and/ordevices, described herein have been described with respect tointeraction between several components. It should be appreciated thatsuch systems and components can include those components orsub-components specified therein, some of the specified components orsub-components, and/or additional components. Sub-components could alsobe implemented as components communicatively coupled to other componentsrather than included within parent components. Further yet, one or morecomponents and/or sub-components may be combined into a single componentproviding aggregate functionality. The components may also interact withone or more other components not specifically described herein for thesake of brevity, but known by those of skill in the art.

In view of the example systems and/or devices described herein, examplemethods that can be implemented in accordance with the disclosed subjectmatter can be further appreciated with reference to flowcharts in FIGS.7-9 . For purposes of simplicity of explanation, example methodsdisclosed herein are presented and described as a series of acts;however, it is to be understood and appreciated that the disclosedsubject matter is not limited by the order of acts, as some acts mayoccur in different orders and/or concurrently with other acts from thatshown and described herein. For example, a method disclosed herein couldalternatively be represented as a series of interrelated states orevents, such as in a state diagram. Moreover, interaction diagram(s) mayrepresent methods in accordance with the disclosed subject matter whendisparate entities enact disparate portions of the methods. Furthermore,not all illustrated acts may be required to implement a method inaccordance with the subject specification. It should be furtherappreciated that the methods disclosed throughout the subjectspecification are capable of being stored on an article of manufactureto facilitate transporting and transferring such methods to computersfor execution by a processor or for storage in a memory.

FIG. 7 illustrates a flow chart of an example method 700 that candesirably detect anomalies relating to events and associated with users(e.g., associated with user accounts or communication devices associatedwith users), in accordance with various aspects and embodiments of thedisclosed subject matter. The method 700 can be employed by, forexample, a system comprising the ADMC, a processor component (e.g., ofor associated with the ADMC), and/or a data store (e.g., of orassociated with the ADMC).

At 702, respective properties associated with a user identity andrespective relationships between the respective properties can beembedded to generate an embedded array comprising bits of data that canbe representative of the respective properties and the respectiverelationships between the respective properties. The ADMC can analyzeinformation associated with the user identity (e.g., information, suchas records, associated with an account associated with the userassociated with the user identity). The information can relate toevents, activities, interactions, communications, or a device(s)associated with the user identity (e.g., associated with the accountassociated with the user), wherein the events, activities, interactions,or communications can be ones that have occurred over a desired periodof time. Based at least in part on the analysis results, the ADMC candetermine the respective properties and the respective relationshipsbetween the respective properties. The respective relationshipsdetermined by the ADMC can comprise temporal, spatial, and/or othercontextual features of such relationships between the respectiveproperties, such as described herein. The ADMC can embed the respectiveproperties and the respective relationships between the respectiveproperties to generate an embedded array comprising the bits of datathat can be representative of the respective properties and therespective relationships between the respective properties.

At 704, a pattern associated with the respective properties and therespective relationships between the respective properties can bedetermined based at least in part on a first analysis of the embeddedarray. The ADMC can train a neural network, based at least in part onapplying respective embedded arrays comprising respective groups of bitsof data to the neural network, to create (e.g., generate) a trainedneural network. The ADMC can determine the respective groups of bits ofdata of the respective embedded arrays based at least in part on theresults of analyzing respective information (e.g., respective records orother information) associated with respective users, and, based at leastin part on such analysis results, determining respective groups ofproperties and respective groups of relationships between properties ofthe respective groups of properties associated with the respectiveusers. The trained neural network can determine or infer the patternassociated with the respective properties and the respectiverelationships between the respective properties based at least in parton the first analysis (e.g., first AI-based analysis) of the embeddedarray.

At 706, an anomaly in the pattern can be detected based at least in parton a second analysis of the pattern, wherein the anomaly can relate toan event associated with the user identity. The ADMC, employing thetrained neural network, can detect, determine, identify, or infer theanomaly in the pattern associated with the respective properties and therespective relationships between the respective properties based atleast in part on a second analysis (e.g., second AI-based analysis) ofthe pattern, wherein the anomaly can relate to an event, interaction,activity, and/or communication associated with the user identity (e.g.,an event associated with the user account of the user associated withthe user identity).

For instance, the trained neural network can be trained to discriminatebetween the embedded array (e.g., the bits of data of the embedded arrayand/or the pattern representative of the bits of data) and therespective embedded arrays (e.g., the respective groups of bits of dataof the respective embedded arrays and/or the respective patternsrepresentative of the respective groups of bits of data) utilized totrain the neural network. Based at least in part on the results ofanalyzing the bits of data of the embedded array applied to the trainedneural network, the trained neural network can detect, determine,identify, or infer the anomaly (e.g., the difference(s)) in the patternassociated with the embedded array relative to the respective patternsassociated with the respective embedded arrays. The anomaly can relateto, for example, fraudulent activity (e.g., by an unauthorized,malicious, and/or fraudulent entity), churn activity (e.g., by the userassociated with the user account), robocall or spam call activity (e.g.,by an unauthorized, malicious, and/or fraudulent entity), and/or otheractivity (e.g., other undesirable activity).

FIG. 8 depicts a flow chart of an example method 800 that can desirablytrain a neural network that can be utilized to detect anomalies relatingto events and associated with users (e.g., associated with user accountsor communication devices associated with users), in accordance withvarious aspects and embodiments of the disclosed subject matter. Themethod 800 can be employed by, for example, a system comprising theADMC, a processor component (e.g., of or associated with the ADMC),and/or a data store (e.g., of or associated with the ADMC).

At 802, respective groups of information associated with respectiveusers can be analyzed. The ADMC can receive the respective groups ofinformation associated with the respective users and their respectivecommunication devices from various data sources, including thecommunication network, the respective user accounts associated with therespective users and/or respective communication devices, stores (e.g.,online stores or brick and mortar stores that sell products (e.g.,communication devices and/or other products) and services (e.g.,communications-related services)), websites (e.g., websites of onlinestores), social networks, and/or other desired data sources. The ADMCcan analyze the respective groups of information associated with therespective users. The respective groups of information can relate to,for example, respective events, activities, interactions,communications, or a device(s) associated with the respective users,wherein the respective events, activities, interactions, orcommunications can be ones that have occurred over a desired period(s)of time.

At 804, based at least in part on the results of such analysis,respective groups of properties and respective groups of relationshipsbetween properties of the respective groups of properties associatedwith the respective users can be determined. The ADMC can determine therespective groups of properties and the respective groups ofrelationships between properties of the respective groups of propertiesassociated with the respective users based at least in part on suchanalysis results.

At 806, the respective groups of properties and the respective groups ofrelationships between properties of the respective groups of propertiesassociated with the respective users can be embedded to generaterespective embedded arrays comprising respective groups of bits of data.Based at least in part on such analysis results, the ADMC can embed(e.g., embed, map, and/or code) the respective groups of properties andthe respective groups of relationships to generate (e.g., create orform) the respective embedded arrays comprising the respective groups ofbits of data. With regard to each of the respective groups of bits ofdata, a group of bits of data can be representative of the respectiveproperties and the respective relationships between propertiesassociated with a user, such as described herein.

At 808, the respective embedded arrays comprising the respective groupsof bits of data can be applied to a neural network. At 810, the neuralnetwork can be trained, based at least in part on the applying of therespective groups of bits of data of the respective embedded arraysapplied to the neural network, to create a trained neural network, inaccordance with an AI-based process. The ADMC can apply (e.g., input)the respective embedded arrays comprising the respective groups of bitsof data to the neural network to facilitate training the neural network.Based at least in part on the applying of the respective groups of bitsof data to the neural network, the ADMC, employing the AI component, candesirably train the neural network to create (e.g., form or generate)the trained neural network, in accordance with the AI-based processand/or associated AI-based algorithms and techniques. As part of thetraining of the trained neural network and/or analysis of the respectivegroups of bits of data performed by the trained neural network duringthe training of the trained neural network, the trained neural networkcan determine, identify, or infer respective patterns associated withthe respective embedded arrays. The ADMC can utilize the trained neuralnetwork to facilitate detecting, determining, identifying, or inferringanomalies (e.g., abnormalities, irregularities) associated with bits ofdata associated with properties and relationships between propertiesassociated with a user (e.g., an account associated with the user), suchas more fully described herein. An anomaly can relate to, for example,fraudulent activity, churn activity, robocall activity, spam activity,and/or other activity (e.g., other undesirable activity).

FIG. 9 depicts a flow chart of another example method 900 that candesirably detect anomalies relating to events and associated with users(e.g., associated with user accounts or communication devices associatedwith users), in accordance with various aspects and embodiments of thedisclosed subject matter. The method 900 can be employed by, forexample, a system comprising the ADMC, a processor component (e.g., ofor associated with the ADMC), and/or a data store (e.g., of orassociated with the ADMC).

At 902, data associated with a user can be received. The ADMC canreceive or obtain the data associated with the user and/or associatedcommunication device(s) from one or more of various data sources. TheADMC can receive the data associated with the user and/or associatedcommunication device(s) from various data sources, including, forexample, the communication network, a user account associated with theuser and/or the communication device(s), stores (e.g., online stores orbrick and mortar stores that sell products (e.g., communication devicesand/or other products) and services (e.g., communications-relatedservices)), websites (e.g., websites of online stores), social networks,and/or other desired data sources. The data associated with the user canrelate to, for example, events, activities, interactions,communications, or the communication device(s) associated with therespective users, wherein the events, activities, interactions, orcommunications can be ones that have occurred over a desired period(s)of time.

At 904, respective properties and respective relationships between therespective properties associated with the user and/or associatedcommunication device(s) can be determined based at least in part on theresults of analyzing the data associated with the user. The ADMC cananalyze the data associated with the user and/or associatedcommunication device. The ADMC can determine or identify the respectiveproperties and the respective relationships between the respectiveproperties associated with the user and/or associated communicationdevice(s) based at least in part on the results of analyzing the dataassociated with the user.

At 906, an embedded array comprising bits of data associated with theuser and/or communication device(s) can be determined, wherein theembedded array can be representative of the respective properties andthe respective relationships between the respective properties. The ADMCcan determine and generate the embedded array comprising the bits ofdata that can be representative of the respective properties and therespective relationships between the respective properties, such as morefully described herein.

At 908, the embedded array comprising the bits of data associated withthe user and/or communication device(s) can be applied to a trainedneural network. The ADMC can apply (e.g., input) the embedded arraycomprising the bits of data to the trained neural network, wherein thetrained neural network can be trained to detect or determine anomalies(e.g., anomalies in data patterns) relating to properties, events,interactions, or activities associated with users, associatedcommunication devices, and/or associated user accounts.

At 910, a pattern relating to the respective properties and therespective relationships between the respective properties can bedetermined based at least in part on the results of an analysis (e.g.,AI-based analysis) of the bits of data. The trained neural network canperform an AI-based analysis (e.g., neural network analysis) on the bitsof data of the embedded array, in accordance with an AI-based analysisprocess and/or AI-based algorithms and techniques. Based at least inpart on the results of such AI-based analysis of the bits of data of theembedded array, the trained neural network can determine the patternrelating to (e.g., representative of or corresponding to) the respectiveproperties and the respective relationships between the respectiveproperties.

At 912, an anomaly can be detected in the pattern relating to therespective properties and the respective relationships between therespective properties associated with the user based at least in part onan analysis of the pattern, wherein the anomaly can relate to an eventassociated with the user. The trained neural network can be trainedbased at least in part on applying respective groups of bits of data ofrespective embedded arrays relating to respective groups of propertiesand respective groups of relationships between properties associatedwith respective users and respective communication devices, such asdescribed herein. As part of the training, the trained neural networkalso can determine, identify, and/or recognize respective patternsrelating to the respective groups of properties and the respectivegroups of relationships between properties associated with therespective users and the respective communication devices, such asdescribed herein.

The trained neural network can perform an AI-based analysis (e.g.,neural network analysis) on the pattern relating to the respectiveproperties and the respective relationships between the respectiveproperties associated with the user. Based at least in part on theresults of the AI-based analysis of the pattern relating to therespective properties and the respective relationships between therespective properties associated with the user, the trained neuralnetwork can determine, identify, or infer the anomaly in the pattern,wherein the anomaly can relate to the event associated with the user(e.g., an event relating to a user account and/or communication deviceassociated with the user). For instance, based at least in part on theresults of the AI-based analysis of the pattern associated with the userand other patterns associated with other users, the trained neuralnetwork can determine, identify, or infer the anomaly in the patternassociated with the user relative to the other patterns associated withthe other users.

At 914, information relating to the anomaly relating to the eventassociated with the user can be presented. The ADMC can present (e.g.,communicate or display) the information relating to the anomaly relatingto the event associated with the user to an entity (e.g., arepresentative associated with the entity that provides products andservices associated with the user account of the user) and/or the userto notify the entity and/or the user if the detected anomaly relating tothe event and associated with the user (e.g., associated with the useraccount of the user). In some instances (e.g., when appropriate), theentity (e.g., representative associated with the entity) can perform adesired action (e.g., responsive or mitigation action) in response tothe detected anomaly. As an example, if the detected anomaly relates toan attempt, or an apparent attempt, by an unauthorized entity (e.g., amalicious entity, fraudster, or criminal) to fraudulently obtain a newcommunication device (e.g., a new or upgraded smart phone) under theuser account associated with the user (e.g., having the user accountcharged for the new communication device), the representative can blockor deny (or the ADMC can automatically block or deny) the attempt by theunauthorized entity to purchase the new communication device under theuser account associated with the user.

Referring now to FIG. 10 , depicted is an example block diagram of anexample communication device 1000 (e.g., wireless or mobile phone,electronic pad or tablet, electronic eyewear, electronic watch, or otherelectronic bodywear, IoT device, or other type of communication device)operable to engage in a system architecture that facilitates wirelesscommunications according to one or more embodiments described herein.Although a communication device is illustrated herein, it will beunderstood that other devices can be a communication device, and thatthe communication device is merely illustrated to provide context forthe embodiments of the various embodiments described herein. Thefollowing discussion is intended to provide a brief, general descriptionof an example of a suitable environment in which the various embodimentscan be implemented. While the description includes a general context ofcomputer-executable instructions embodied on a machine-readable storagemedium, those skilled in the art will recognize that the disclosedsubject matter also can be implemented in combination with other programmodules and/or as a combination of hardware and software.

Generally, applications (e.g., program modules) can include routines,programs, components, data structures, etc., that perform particulartasks or implement particular abstract data types. Moreover, thoseskilled in the art will appreciate that the methods described herein canbe practiced with other system configurations, includingsingle-processor or multiprocessor systems, minicomputers, mainframecomputers, as well as personal computers, hand-held computing devices,microprocessor-based or programmable consumer electronics, and the like,each of which can be operatively coupled to one or more associateddevices.

A computing device can typically include a variety of machine-readablemedia. Machine-readable media can be any available media that can beaccessed by the computer and includes both volatile and non-volatilemedia, removable and non-removable media. By way of example and notlimitation, computer-readable media can comprise computer storage mediaand communication media. Computer storage media can include volatileand/or non-volatile media, removable and/or non-removable mediaimplemented in any method or technology for storage of information, suchas computer-readable instructions, data structures, program modules, orother data. Computer storage media can include, but is not limited to,RAM, ROM, EEPROM, flash memory or other memory technology, solid statedrive (SSD) or other solid-state storage technology, Compact Disk ReadOnly Memory (CD ROM), digital video disk (DVD), Blu-ray disk, or otheroptical disk storage, magnetic cassettes, magnetic tape, magnetic diskstorage or other magnetic storage devices, or any other medium which canbe used to store the desired information and which can be accessed bythe computer. In this regard, the terms “tangible” or “non-transitory”herein as applied to storage, memory or computer-readable media, are tobe understood to exclude only propagating transitory signals per se asmodifiers and do not relinquish rights to all standard storage, memoryor computer-readable media that are not only propagating transitorysignals per se.

Communication media typically embodies computer-readable instructions,data structures, program modules, or other data in a modulated datasignal such as a carrier wave or other transport mechanism, and includesany information delivery media. The term “modulated data signal” means asignal that has one or more of its characteristics set or changed insuch a manner as to encode information in the signal. By way of example,and not limitation, communication media includes wired media such as awired network or direct-wired connection, and wireless media such asacoustic, RF, infrared and other wireless media. Combinations of the anyof the above should also be included within the scope ofcomputer-readable media.

The communication device 1000 can include a processor 1002 forcontrolling and processing all onboard operations and functions. Amemory 1004 interfaces to the processor 1002 for storage of data and oneor more applications 1006 (e.g., a video player software, user feedbackcomponent software, or other type of application). Other applicationscan include voice recognition of predetermined voice commands thatfacilitate initiation of the user feedback signals. The applications1006 can be stored in the memory 1004 and/or in a firmware 1008, andexecuted by the processor 1002 from either or both the memory 1004or/and the firmware 1008. The firmware 1008 can also store startup codefor execution in initializing the communication device 1000. Acommunication component 1010 interfaces to the processor 1002 tofacilitate wired/wireless communication with external systems, e.g.,cellular networks, VoIP networks, and so on. Here, the communicationcomponent 1010 can also include a suitable cellular transceiver 1011(e.g., a GSM transceiver) and/or an unlicensed transceiver 1013 (e.g.,Wi-Fi, WiMax) for corresponding signal communications. The communicationdevice 1000 can be a device such as a cellular telephone, a PDA withmobile communications capabilities, and messaging-centric devices. Thecommunication component 1010 also facilitates communications receptionfrom terrestrial radio networks (e.g., broadcast), digital satelliteradio networks, and Internet-based radio services networks.

The communication device 1000 includes a display 1012 for displayingtext, images, video, telephony functions (e.g., a Caller ID function),setup functions, and for user input. For example, the display 1012 canalso be referred to as a “screen” that can accommodate the presentationof multimedia content (e.g., music metadata, messages, wallpaper,graphics, or other content). The display 1012 can also display videosand can facilitate the generation, editing and sharing of video quotes.A serial I/O interface 1014 is provided in communication with theprocessor 1002 to facilitate wired and/or wireless serial communications(e.g., USB, and/or IEEE 1394) through a hardwire connection, and otherserial input devices (e.g., a keyboard, keypad, and mouse). Thissupports updating and troubleshooting the communication device 1000, forexample. Audio capabilities are provided with an audio I/O component1016, which can include a speaker for the output of audio signalsrelated to, for example, indication that the user pressed the proper keyor key combination to initiate the user feedback signal. The audio I/Ocomponent 1016 also facilitates the input of audio signals through amicrophone to record data and/or telephony voice data, and for inputtingvoice signals for telephone conversations.

The communication device 1000 can include a slot interface 1018 foraccommodating a SIC (Subscriber Identity Component) in the form factorof a card Subscriber Identity Module (SIM) or universal SIM 1020, andinterfacing the SIM card 1020 with the processor 1002. However, it is tobe appreciated that the SIM card 1020 can be manufactured into thecommunication device 1000, and updated by downloading data and software.

The communication device 1000 can process IP data traffic through thecommunication component 1010 to accommodate IP traffic from an IPnetwork such as, for example, the Internet, a corporate intranet, a homenetwork, a person area network, or other network, through an ISP orbroadband cable provider. Thus, VoIP traffic can be utilized by thecommunication device 1000 and IP-based multimedia content can bereceived in either an encoded or a decoded format.

A video processing component 1022 (e.g., a camera) can be provided fordecoding encoded multimedia content. The video processing component 1022can aid in facilitating the generation, editing, and sharing of videoquotes. The communication device 1000 also includes a power source 1024in the form of batteries and/or an AC power subsystem, which powersource 1024 can interface to an external power system or chargingequipment (not shown) by a power I/O component 1026.

The communication device 1000 can also include a video component 1030for processing video content received and, for recording andtransmitting video content. For example, the video component 1030 canfacilitate the generation, editing and sharing of video quotes. Alocation tracking component 1032 facilitates geographically locating thecommunication device 1000. As described hereinabove, this can occur whenthe user initiates the feedback signal automatically or manually. A userinput component 1034 facilitates the user initiating the qualityfeedback signal. The user input component 1034 can also facilitate thegeneration, editing and sharing of video quotes. The user inputcomponent 1034 can include such conventional input device technologiessuch as a keypad, keyboard, mouse, stylus pen, and/or touch screen, forexample.

Referring again to the applications 1006, a hysteresis component 1036facilitates the analysis and processing of hysteresis data, which isutilized to determine when to associate with the access point. Asoftware trigger component 1038 can be provided that facilitatestriggering of the hysteresis component 1036 when the Wi-Fi transceiver1013 detects the beacon of the access point. A SIP client 1040 enablesthe communication device 1000 to support SIP protocols and register thesubscriber with the SIP registrar server. The applications 1006 can alsoinclude a client 1042 that provides at least the capability ofdiscovery, play and store of multimedia content, for example, music.

The communication device 1000, as indicated above related to thecommunication component 1010, includes an indoor network radiotransceiver 1013 (e.g., Wi-Fi transceiver). This function supports theindoor radio link, such as IEEE 802.11, for the dual-mode GSM device(e.g., communication device 1000). The communication device 1000 canaccommodate at least satellite radio services through a device (e.g.,handset device) that can combine wireless voice and digital radiochipsets into a single device (e.g., single handheld device).

FIG. 11 illustrates a block diagram of an example AP 1100 (e.g., macrobase station, femto AP, pico AP, Wi-Fi AP, Wi-Fi-direct AP, or othertype of AP), in accordance with various aspects and embodiments of thedisclosed subject matter. The AP 1100 can receive and transmit signal(s)from and to wireless devices like access points (e.g., base stations,femtocells, picocells, or other type of access point), access terminals(e.g., UEs), wireless ports and routers, and the like, through a set ofantennas 1169 ₁-1169 _(R). In an aspect, the antennas 1169 ₁-1169 _(R)are a part of a communication platform 1102, which comprises electroniccomponents and associated circuitry that can provide for processing andmanipulation of received signal(s) and signal(s) to be transmitted. Inan aspect, the communication platform 1102 can include areceiver/transmitter 1104 that can convert signal from analog to digitalupon reception, and from digital to analog upon transmission. Inaddition, receiver/transmitter 1104 can divide a single data stream intomultiple, parallel data streams, or perform the reciprocal operation.

In an aspect, coupled to receiver/transmitter 1104 can be amultiplexer/demultiplexer (mux/demux) 1106 that can facilitatemanipulation of signal in time and frequency space. The mux/demux 1106can multiplex information (e.g., data/traffic and control/signaling)according to various multiplexing schemes such as, for example, timedivision multiplexing (TDM), frequency division multiplexing (FDM),orthogonal frequency division multiplexing (OFDM), code divisionmultiplexing (CDM), space division multiplexing (SDM), etc. In addition,mux/demux component 1106 can scramble and spread information (e.g.,codes) according to substantially any code known in the art, e.g.,Hadamard-Walsh codes, Baker codes, Kasami codes, polyphase codes, and soon. A modulator/demodulator (mod/demod) 1108 also can be part of thecommunication platform 1102, and can modulate information according tomultiple modulation techniques, such as frequency modulation, amplitudemodulation (e.g., M-ary quadrature amplitude modulation (QAM), with M apositive integer), phase-shift keying (PSK), and the like.

The AP 1100 also can comprise a processor(s) 1110 that can be configuredto confer and/or facilitate providing functionality, at least partially,to substantially any electronic component in or associated with the AP1100. For instance, the processor(s) 1110 can facilitate performance ofoperations on data (e.g., symbols, bits, or chips) formultiplexing/demultiplexing, modulation/demodulation, such as effectingdirect and inverse fast Fourier transforms, selection of modulationrates, selection of data packet formats, inter-packet times, or otheroperations on data.

In another aspect, the AP 1100 can include a data store 1112 that canstore data structures; code instructions; rate coding information;information relating to measurement of radio link quality or receptionof information related thereto; information relating to communicationconditions (e.g., SINR, implicit NACK rate, RSRP, RSRQ, CQI, and/orother wireless communications metrics or parameters) associated withcommunication devices, parameter data, threshold values associated withparameters, ACK/NACK-related information (e.g., ACK/NACK statusinformation), time-related information, metadata, communication devices,policies and rules, users, applications, services, communicationmanagement criteria, traffic flows, signaling, algorithms (e.g.,communication management algorithm(s), mapping algorithm(s), or otheralgorithm), protocols, interfaces, tools, and/or other information,etc.; white list information, information relating to managing ormaintaining the white list; system or device information like policiesand specifications; code sequences for scrambling; spreading and pilottransmission; floor plan configuration; access point deployment andfrequency plans; scheduling policies; and so on. The processor(s) 1110can be coupled to the data store 1112 in order to store and retrieveinformation (e.g., information, such as algorithms, relating tomultiplexing/demultiplexing or modulation/demodulation; informationrelating to radio link levels; information relating to communicationconditions (e.g., SINR, implicit NACK rate, RSRP, RSRQ, CQI, and/orother wireless communications metrics or parameters) associated withcommunication devices, parameter data, threshold values associated withthe parameters, ACK/NACK-related information (e.g., ACK/NACK statusinformation), time-related information, metadata, communication devices,policies and rules, users, applications, services, communicationmanagement criteria, traffic flows, signaling, algorithms (e.g.,communication management algorithm(s), mapping algorithm(s), or otheralgorithm), protocols, interfaces, tools, and/or other information)desired to operate and/or confer functionality to the communicationplatform 1102 and/or other operational components of AP 1100.

In order to provide additional context for various embodiments describedherein, FIG. 12 and the following discussion are intended to provide abrief, general description of a suitable computing environment 1200 inwhich the various embodiments of the embodiments described herein can beimplemented. While the embodiments have been described above in thegeneral context of computer-executable instructions that can run on oneor more computers, those skilled in the art will recognize that theembodiments can be also implemented in combination with other programmodules and/or as a combination of hardware and software.

Generally, program modules include routines, programs, components, datastructures, etc., that perform particular tasks or implement particularabstract data types. Moreover, those skilled in the art will appreciatethat the methods can be practiced with other computer systemconfigurations, including single-processor or multiprocessor computersystems, minicomputers, mainframe computers, Internet of Things (IoT)devices, distributed computing systems, as well as personal computers,hand-held computing devices, microprocessor-based or programmableconsumer electronics, and the like, each of which can be operativelycoupled to one or more associated devices.

The illustrated embodiments of the embodiments herein can be alsopracticed in distributed computing environments where certain tasks areperformed by remote processing devices that are linked through acommunications network. In a distributed computing environment, programmodules can be located in both local and remote memory storage devices.

Computing devices typically include a variety of media, which caninclude computer-readable storage media, machine-readable storage media,and/or communications media, which two terms are used herein differentlyfrom one another as follows. Computer-readable storage media ormachine-readable storage media can be any available storage media thatcan be accessed by the computer and includes both volatile andnonvolatile media, removable and non-removable media. By way of example,and not limitation, computer-readable storage media or machine-readablestorage media can be implemented in connection with any method ortechnology for storage of information such as computer-readable ormachine-readable instructions, program modules, structured data orunstructured data.

Computer-readable storage media can include, but are not limited to,random access memory (RAM), read only memory (ROM), electricallyerasable programmable read only memory (EEPROM), flash memory or othermemory technology, compact disk read only memory (CD-ROM), digitalversatile disk (DVD), Blu-ray disc (BD) or other optical disk storage,magnetic cassettes, magnetic tape, magnetic disk storage or othermagnetic storage devices, solid state drives or other solid statestorage devices, or other tangible and/or non-transitory media which canbe used to store desired information. In this regard, the terms“tangible” or “non-transitory” herein as applied to storage, memory orcomputer-readable media, are to be understood to exclude onlypropagating transitory signals per se as modifiers and do not relinquishrights to all standard storage, memory or computer-readable media thatare not only propagating transitory signals per se.

Computer-readable storage media can be accessed by one or more local orremote computing devices, e.g., via access requests, queries or otherdata retrieval protocols, for a variety of operations with respect tothe information stored by the medium.

Communications media typically embody computer-readable instructions,data structures, program modules or other structured or unstructureddata in a data signal such as a modulated data signal, e.g., a carrierwave or other transport mechanism, and includes any information deliveryor transport media. The term “modulated data signal” or signals refersto a signal that has one or more of its characteristics set or changedin such a manner as to encode information in one or more signals. By wayof example, and not limitation, communication media include wired media,such as a wired network or direct-wired connection, and wireless mediasuch as acoustic, RF, infrared and other wireless media.

With reference again to FIG. 12 , the example environment 1200 forimplementing various embodiments of the aspects described hereinincludes a computer 1202, the computer 1202 including a processing unit1204, a system memory 1206 and a system bus 1208. The system bus 1208couples system components including, but not limited to, the systemmemory 1206 to the processing unit 1204. The processing unit 1204 can beany of various commercially available processors. Dual microprocessorsand other multi-processor architectures can also be employed as theprocessing unit 1204.

The system bus 1208 can be any of several types of bus structure thatcan further interconnect to a memory bus (with or without a memorycontroller), a peripheral bus, and a local bus using any of a variety ofcommercially available bus architectures. The system memory 1206includes ROM 1210 and RAM 1212. A basic input/output system (BIOS) canbe stored in a non-volatile memory such as ROM, erasable programmableread only memory (EPROM), EEPROM, which BIOS contains the basic routinesthat help to transfer information between elements within the computer1202, such as during startup. The RAM 1212 can also include a high-speedRAM such as static RAM for caching data.

The computer 1202 further includes an internal hard disk drive (HDD)1214 (e.g., EIDE, SATA), one or more external storage devices 1216(e.g., a magnetic floppy disk drive (FDD) 1216, a memory stick or flashdrive reader, a memory card reader, or other type of storage device) andan optical disk drive 1220 (e.g., which can read or write from a CD-ROMdisc, a DVD, a BD, or other disk drive). While the internal HDD 1214 isillustrated as located within the computer 1202, the internal HDD 1214can also be configured for external use in a suitable chassis (notshown). Additionally, while not shown in environment 1200, a solid statedrive (SSD) could be used in addition to, or in place of, an HDD 1214.The HDD 1214, external storage device(s) 1216 and optical disk drive1220 can be connected to the system bus 1208 by an HDD interface 1224,an external storage interface 1226 and an optical drive interface 1228,respectively. The interface 1224 for external drive implementations caninclude at least one or both of Universal Serial Bus (USB) and Instituteof Electrical and Electronics Engineers (IEEE) 1394 interfacetechnologies. Other external drive connection technologies are withincontemplation of the embodiments described herein.

The drives and their associated computer-readable storage media providenonvolatile storage of data, data structures, computer-executableinstructions, and so forth. For the computer 1202, the drives andstorage media accommodate the storage of any data in a suitable digitalformat. Although the description of computer-readable storage mediaabove refers to respective types of storage devices, it should beappreciated by those skilled in the art that other types of storagemedia which are readable by a computer, whether presently existing ordeveloped in the future, could also be used in the example operatingenvironment, and further, that any such storage media can containcomputer-executable instructions for performing the methods describedherein.

A number of program modules can be stored in the drives and RAM 1212,including an operating system 1230, one or more application programs1232, other program modules 1234 and program data 1236. All or portionsof the operating system, applications, modules, and/or data can also becached in the RAM 1212. The systems and methods described herein can beimplemented utilizing various commercially available operating systemsor combinations of operating systems.

Computer 1202 can optionally comprise emulation technologies. Forexample, a hypervisor (not shown) or other intermediary can emulate ahardware environment for operating system 1230, and the emulatedhardware can optionally be different from the hardware illustrated inFIG. 12 . In such an embodiment, operating system 1230 can comprise onevirtual machine (VM) of multiple VMs hosted at computer 1202.Furthermore, operating system 1230 can provide runtime environments,such as the Java runtime environment or the .NET framework, forapplications 1232. Runtime environments are consistent executionenvironments that allow applications 1232 to run on any operating systemthat includes the runtime environment. Similarly, operating system 1230can support containers, and applications 1232 can be in the form ofcontainers, which are lightweight, standalone, executable packages ofsoftware that include, e.g., code, runtime, system tools, systemlibraries and settings for an application.

Further, computer 1202 can be enable with a security module, such as atrusted processing module (TPM). For instance with a TPM, bootcomponents hash next in time boot components, and wait for a match ofresults to secured values, before loading a next boot component. Thisprocess can take place at any layer in the code execution stack ofcomputer 1202, e.g., applied at the application execution level or atthe operating system (OS) kernel level, thereby enabling security at anylevel of code execution.

A user can enter commands and information into the computer 1202 throughone or more wired/wireless input devices, e.g., a keyboard 1238, a touchscreen 1240, and a pointing device, such as a mouse 1242. Other inputdevices (not shown) can include a microphone, an infrared (IR) remotecontrol, a radio frequency (RF) remote control, or other remote control,a joystick, a virtual reality controller and/or virtual reality headset,a game pad, a stylus pen, an image input device, e.g., camera(s), agesture sensor input device, a vision movement sensor input device, anemotion or facial detection device, a biometric input device, e.g.,fingerprint or iris scanner, or the like. These and other input devicesare often connected to the processing unit 1204 through an input deviceinterface 1244 that can be coupled to the system bus 1208, but can beconnected by other interfaces, such as a parallel port, an IEEE 1394serial port, a game port, a USB port, an IR interface, a BLUETOOTH′interface, or other type of interface.

A monitor 1246 or other type of display device can be also connected tothe system bus 1208 via an interface, such as a video adapter 1248. Inaddition to the monitor 1246, a computer typically includes otherperipheral output devices (not shown), such as speakers, printers, orother type of peripheral output device.

The computer 1202 can operate in a networked environment using logicalconnections via wired and/or wireless communications to one or moreremote computers, such as a remote computer(s) 1250. The remotecomputer(s) 1250 can be a workstation, a server computer, a router, apersonal computer, portable computer, microprocessor-based entertainmentappliance, a peer device or other common network node, and typicallyincludes many or all of the elements described relative to the computer1202, although, for purposes of brevity, only a memory/storage device1252 is illustrated. The logical connections depicted includewired/wireless connectivity to a local area network (LAN) 1254 and/orlarger networks, e.g., a wide area network (WAN) 1256. Such LAN and WANnetworking environments are commonplace in offices and companies, andfacilitate enterprise-wide computer networks, such as intranets, all ofwhich can connect to a global communications network, e.g., theInternet.

When used in a LAN networking environment, the computer 1202 can beconnected to the local network 1254 through a wired and/or wirelesscommunication network interface or adapter 1258. The adapter 1258 canfacilitate wired or wireless communication to the LAN 1254, which canalso include a wireless access point (AP) disposed thereon forcommunicating with the adapter 1258 in a wireless mode.

When used in a WAN networking environment, the computer 1202 can includea modem 1260 or can be connected to a communications server on the WAN1256 via other means for establishing communications over the WAN 1256,such as by way of the Internet. The modem 1260, which can be internal orexternal and a wired or wireless device, can be connected to the systembus 1208 via the input device interface 1244. In a networkedenvironment, program modules depicted relative to the computer 1202 orportions thereof, can be stored in the remote memory/storage device1252. It will be appreciated that the network connections shown areexample and other means of establishing a communications link betweenthe computers can be used.

When used in either a LAN or WAN networking environment, the computer1202 can access cloud storage systems or other network-based storagesystems in addition to, or in place of, external storage devices 1216 asdescribed above. Generally, a connection between the computer 1202 and acloud storage system can be established over a LAN 1254 or WAN 1256,e.g., by the adapter 1258 or modem 1260, respectively. Upon connectingthe computer 1202 to an associated cloud storage system, the externalstorage interface 1226 can, with the aid of the adapter 1258 and/ormodem 1260, manage storage provided by the cloud storage system as itwould other types of external storage. For instance, the externalstorage interface 1226 can be configured to provide access to cloudstorage sources as if those sources were physically connected to thecomputer 1202.

The computer 1202 can be operable to communicate with any wirelessdevices or entities operatively disposed in wireless communication,e.g., a printer, scanner, desktop and/or portable computer, portabledata assistant, communications satellite, any piece of equipment orlocation associated with a wirelessly detectable tag (e.g., a kiosk,news stand, store shelf, or other equipment or entity), and telephone.This can include Wireless Fidelity (Wi-Fi) and BLUETOOTH™ wirelesstechnologies. Thus, the communication can be a predefined structure aswith a conventional network or simply an ad hoc communication between atleast two devices.

Wi-Fi, or Wireless Fidelity, allows connection to the Internet from acouch at home, in a hotel room, or a conference room at work, withoutwires. Wi-Fi is a wireless technology similar to that used in a cellphone that enables such devices, e.g., computers, to send and receivedata indoors and out; anywhere within the range of a base station. Wi-Finetworks use radio technologies called IEEE 802.11 (a, b, g, or otheralphanumeric character) to provide secure, reliable, fast wirelessconnectivity. A Wi-Fi network can be used to connect computers to eachother, to the Internet, and to wired networks (which use IEEE 802.3 orEthernet). Wi-Fi networks operate in the unlicensed 2.4 and 5 GHz radiobands, at an 11 Mbps (802.11a) or 54 Mbps (802.11b) data rate, forexample, or with products that contain both bands (dual band), so thenetworks can provide real-world performance similar to the basic 10BaseTwired Ethernet networks used in many offices.

It is to be noted that aspects, features, and/or advantages of thedisclosed subject matter can be exploited in substantially any wirelesstelecommunication or radio technology, e.g., Wi-Fi; Gi-Fi; Hi-Fi;BLUETOOTH™; worldwide interoperability for microwave access (WiMAX);enhanced general packet radio service (enhanced GPRS); third generationpartnership project (3GPP) long term evolution (LTE); third generationpartnership project 2 (3GPP2) ultra mobile broadband (UMB); 3GPPuniversal mobile telecommunication system (UMTS); high speed packetaccess (HSPA); high speed downlink packet access (HSDPA); high speeduplink packet access (HSUPA); GSM (global system for mobilecommunications) EDGE (enhanced data rates for GSM evolution) radioaccess network (GERAN); UMTS terrestrial radio access network (UTRAN);LTE advanced (LTE-A); or other type of wireless telecommunication orradio technology. Additionally, some or all of the aspects describedherein can be exploited in legacy telecommunication technologies, e.g.,GSM. In addition, mobile as well non-mobile networks (e.g., theinternet, data service network such as internet protocol television(IPTV), or other network) can exploit aspects or features describedherein.

Various aspects or features described herein can be implemented as amethod, apparatus, system, or article of manufacture using standardprogramming or engineering techniques. In addition, various aspects orfeatures disclosed in the subject specification can also be realizedthrough program modules that implement at least one or more of themethods disclosed herein, the program modules being stored in a memoryand executed by at least a processor. Other combinations of hardware andsoftware or hardware and firmware can enable or implement aspectsdescribed herein, including disclosed method(s). The term “article ofmanufacture” as used herein is intended to encompass a computer programaccessible from any computer-readable device, carrier, or storage media.For example, computer-readable storage media can include but are notlimited to magnetic storage devices (e.g., hard disk, floppy disk,magnetic strips, or other type of magnetic storage device), opticaldiscs (e.g., compact disc (CD), digital versatile disc (DVD), blu-raydisc (BD), or other type of optical disc), smart cards, and memorydevices comprising volatile memory and/or non-volatile memory (e.g.,flash memory devices, such as, for example, card, stick, key drive, orother type of memory device), or the like. In accordance with variousimplementations, computer-readable storage media can be non-transitorycomputer-readable storage media and/or a computer-readable storagedevice can comprise computer-readable storage media.

As it is employed in the subject specification, the term “processor” canrefer to substantially any computing processing unit or devicecomprising, but not limited to, single-core processors;single-processors with software multithread execution capability;multi-core processors; multi-core processors with software multithreadexecution capability; multi-core processors with hardware multithreadtechnology; parallel platforms; and parallel platforms with distributedshared memory. A processor can be or can comprise, for example, multipleprocessors that can include distributed processors or parallelprocessors in a single machine or multiple machines. Additionally, aprocessor can comprise or refer to an integrated circuit, an applicationspecific integrated circuit (ASIC), a digital signal processor (DSP), aprogrammable gate array (PGA), a field PGA (FPGA), a programmable logiccontroller (PLC), a complex programmable logic device (CPLD), a statemachine, a discrete gate or transistor logic, discrete hardwarecomponents, or any combination thereof designed to perform the functionsdescribed herein. Further, processors can exploit nano-scalearchitectures such as, but not limited to, molecular and quantum-dotbased transistors, switches and gates, in order to optimize space usageor enhance performance of user equipment. A processor may also beimplemented as a combination of computing processing units.

A processor can facilitate performing various types of operations, forexample, by executing computer-executable instructions. When a processorexecutes instructions to perform operations, this can include theprocessor performing (e.g., directly performing) the operations and/orthe processor indirectly performing operations, for example, byfacilitating (e.g., facilitating operation of), directing, controlling,or cooperating with one or more other devices or components to performthe operations. In some implementations, a memory can storecomputer-executable instructions, and a processor can be communicativelycoupled to the memory, wherein the processor can access or retrievecomputer-executable instructions from the memory and can facilitateexecution of the computer-executable instructions to perform operations.

In certain implementations, a processor can be or can comprise one ormore processors that can be utilized in supporting a virtualizedcomputing environment or virtualized processing environment. Thevirtualized computing environment may support one or more virtualmachines representing computers, servers, or other computing devices. Insuch virtualized virtual machines, components such as processors andstorage devices may be virtualized or logically represented.

In the subject specification, terms such as “store,” “storage,” “datastore,” data storage,” “database,” and substantially any otherinformation storage component relevant to operation and functionality ofa component are utilized to refer to “memory components,” entitiesembodied in a “memory,” or components comprising a memory. It is to beappreciated that memory and/or memory components described herein can beeither volatile memory or nonvolatile memory, or can include bothvolatile and nonvolatile memory.

By way of illustration, and not limitation, nonvolatile memory caninclude read only memory (ROM), programmable ROM (PROM), electricallyprogrammable ROM (EPROM), electrically erasable ROM (EEPROM), or flashmemory. Volatile memory can include random access memory (RAM), whichacts as external cache memory. By way of illustration and notlimitation, RAM is available in many forms such as synchronous RAM(SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rateSDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), anddirect Rambus RAM (DRRAM). Additionally, the disclosed memory componentsof systems or methods herein are intended to comprise, without beinglimited to comprising, these and any other suitable types of memory.

As used in this application, the terms “component”, “system”,“platform”, “framework”, “layer”, “interface”, “agent”, and the like,can refer to and/or can include a computer-related entity or an entityrelated to an operational machine with one or more specificfunctionalities. The entities disclosed herein can be either hardware, acombination of hardware and software, software, or software inexecution. For example, a component may be, but is not limited to being,a process running on a processor, a processor, an object, an executable,a thread of execution, a program, and/or a computer. By way ofillustration, both an application running on a server and the server canbe a component. One or more components may reside within a processand/or thread of execution and a component may be localized on onecomputer and/or distributed between two or more computers.

In another example, respective components can execute from variouscomputer readable media having various data structures stored thereon.The components may communicate via local and/or remote processes such asin accordance with a signal having one or more data packets (e.g., datafrom one component interacting with another component in a local system,distributed system, and/or across a network such as the Internet withother systems via the signal). As another example, a component can be anapparatus with specific functionality provided by mechanical partsoperated by electric or electronic circuitry, which is operated by asoftware or firmware application executed by a processor. In such acase, the processor can be internal or external to the apparatus and canexecute at least a part of the software or firmware application. As yetanother example, a component can be an apparatus that provides specificfunctionality through electronic components without mechanical parts,wherein the electronic components can include a processor or other meansto execute software or firmware that confers at least in part thefunctionality of the electronic components. In an aspect, a componentcan emulate an electronic component via a virtual machine, e.g., withina cloud computing system.

In addition, the term “or” is intended to mean an inclusive “or” ratherthan an exclusive “or.” That is, unless specified otherwise, or clearfrom context, “X employs A or B” is intended to mean any of the naturalinclusive permutations. That is, if X employs A; X employs B; or Xemploys both A and B, then “X employs A or B” is satisfied under any ofthe foregoing instances. Moreover, articles “a” and “an” as used in thesubject specification and annexed drawings should generally be construedto mean “one or more” unless specified otherwise or clear from contextto be directed to a singular form.

Moreover, terms like “user equipment” (UE), “mobile station,” “mobile,”“wireless device,” “wireless communication device,” “subscriberstation,” “subscriber equipment,” “access terminal,” “terminal,”“handset,” and similar terminology are used herein to refer to awireless device utilized by a subscriber or user of a wirelesscommunication service to receive or convey data, control, voice, video,sound, gaming, or substantially any data-stream or signaling-stream. Theforegoing terms are utilized interchangeably in the subjectspecification and related drawings. Likewise, the terms “access point”(AP), “base station,” “node B,” “evolved node B” (eNode B or eNB), “homenode B” (HNB), “home access point” (HAP), and the like are utilizedinterchangeably in the subject application, and refer to a wirelessnetwork component or appliance that serves and receives data, control,voice, video, sound, gaming, or substantially any data-stream orsignaling-stream from a set of subscriber stations. Data and signalingstreams can be packetized or frame-based flows.

Furthermore, the terms “user,” “subscriber,” “customer,” “consumer,”“owner,” “agent,” and the like are employed interchangeably throughoutthe subject specification, unless context warrants particulardistinction(s) among the terms. It should be appreciated that such termscan refer to human entities or automated components supported throughartificial intelligence (e.g., a capacity to make inference based oncomplex mathematical formalisms), which can provide simulated vision,sound recognition and so forth.

As used herein, the terms “example,” “exemplary,” and/or “demonstrative”are utilized to mean serving as an example, instance, or illustration.For the avoidance of doubt, the subject matter disclosed herein is notlimited by such examples. In addition, any aspect or design describedherein as an “example,” “exemplary,” and/or “demonstrative” is notnecessarily to be construed as preferred or advantageous over otheraspects or designs, nor is it meant to preclude equivalent exemplarystructures and techniques known to those of ordinary skill in the art.Furthermore, to the extent that the terms “includes,” “has,” “contains,”and other similar words are used in either the detailed description orthe claims, such terms are intended to be inclusive, in a manner similarto the term “comprising” as an open transition word, without precludingany additional or other elements.

It is to be appreciated and understood that components (e.g.,communication network, network equipment, anomaly detection managementcomponent (ADMC), communication device, AI component, neural network,trained neural network, processor component, data store, or othercomponent), as described with regard to a particular system or method,can include the same or similar functionality as respective components(e.g., respectively named components or similarly named components) asdescribed with regard to other systems or methods disclosed herein.

What has been described above includes examples of systems and methodsthat provide advantages of the disclosed subject matter. It is, ofcourse, not possible to describe every conceivable combination ofcomponents or methods for purposes of describing the disclosed subjectmatter, but one of ordinary skill in the art may recognize that manyfurther combinations and permutations of the disclosed subject matterare possible. Furthermore, to the extent that the terms “includes,”“has,” “possesses,” and the like are used in the detailed description,claims, appendices and drawings such terms are intended to be inclusivein a manner similar to the term “comprising” as “comprising” isinterpreted when employed as a transitional word in a claim.

What is claimed is:
 1. A method, comprising: embedding, by a systemcomprising a processor, respective properties associated with a useridentity and respective relationships between the respective propertiesto generate an embedded array comprising bits of data representative ofthe respective properties and the respective relationships between therespective properties; determining, by the system, a pattern associatedwith the respective properties and the respective relationships betweenthe respective properties based on a first analysis of the embeddedarray; and detecting, by the system, an anomaly in the pattern based ona second analysis of the pattern, wherein the anomaly relates to anevent associated with the user identity.
 2. The method of claim 1,wherein a first amount of data, relating to the respective propertiesand the respective relationships and that is utilized to embed therespective properties and the respective relationships to generate theembedded array, is greater than a second amount of data contained in thebits of data.
 3. The method of claim 1, further comprising: applying, bythe system, respective embedded arrays comprising respective groups ofbits of data to a neural network, wherein the respective groups of bitsof data are representative of respective groups of properties andrespective groups of relationships between properties of the respectivegroups of properties; and training, by the system, the neural network,based on the respective groups of bits of data applied to the neuralnetwork, to create a trained neural network.
 4. The method of claim 3,wherein the training of the neural network comprises performing anartificial intelligence-based analysis on the respective embeddedarrays, in accordance with an artificial intelligence-based process. 5.The method of claim 3, further comprising: applying, by the system, thebits of data of the embedded array to the trained neural network,wherein the determining of the pattern comprises determining, by thetrained neural network of the system, the pattern associated with therespective properties and the respective relationships between therespective properties based on the applying of the bits of data of theembedded array to the trained neural network, wherein the detecting ofthe anomaly comprises detecting, by the trained neural network of thesystem, the anomaly in the pattern based on comparing the patternassociated with the embedded array to other patterns associated with therespective embedded arrays, and wherein the second analysis comprisesthe comparing.
 6. The method of claim 3, wherein the event is a secondevent, wherein the respective properties comprise a first propertyassociated with a first event and a second property associated with thesecond event, wherein the respective relationships comprise arelationship between the first property and the second property, whereinthe bits of data of the embedded array comprise a first bit of dataassociated with the first property, a second bit of data associated withthe second property, and a third bit of data associated with therelationship, and wherein the first bit of data, the second bit of data,and the third bit of data are arranged in respective locations and in astructured order in relation to each other in the embedded array basedon the first property, the first event, the second property, the secondevent, or the relationship.
 7. The method of claim 6, furthercomprising: as part of the second analysis: determining, by the trainedneural network of the system, that the first property, individually, isnot anomalous based on the first bit; determining, by the trained neuralnetwork of the system, that the second property, individually, is notanomalous based on the second bit; and determining, by the trainedneural network of the system, that the relationship between the firstproperty and the second property is the anomaly based on the first bit,the second bit, or the third bit.
 8. The method of claim 6, furthercomprising: as part of the second analysis, determining, by the trainedneural network of the system, that the anomaly in the pattern relates tothe first property based on the first bit or relates to the secondproperty based on the second bit.
 9. The method of claim 6, wherein therelationship between the first property and the second property relatesto an amount of time between the first event and the second event, afirst location associated with the first event in relation to a secondlocation associated with the second event, or a first activityassociated with the first event in relation to a second activityassociated with the second event.
 10. The method of claim 1, wherein abit of data of the bits of data contains a Boolean value, an integervalue, a floating point number, a complex value, a shape, an indicator,or an alphanumeric value.
 11. The method of claim 1, wherein the anomalyrelates to a fraudulent activity, a churn activity, a robocall activity,or a spam activity.
 12. The method of claim 1, further comprising:compressing, by the system, the embedded array to reduce an amount ofstorage space utilized by the bits of data of the embedded array.
 13. Asystem, comprising: a processor; and a memory that stores executableinstructions that, when executed by the processor, facilitateperformance of operations, comprising: mapping respective attributesassociated with an entity identity and respective relationships betweenthe respective attributes to generate an embedded array comprising bitsof data representative of the respective attributes and the respectiverelationships between the respective attributes; determining a patternassociated with the respective attributes and the respectiverelationships between the respective attributes based on a firstanalysis of the embedded array; and determining an anomaly in thepattern based on a second analysis of the pattern, wherein the anomalyrelates to an event associated with the entity identity.
 14. The systemof claim 13, wherein a first amount of information relating to therespective attributes and the respective relationships that is utilizedto embed the respective attributes and the respective relationships togenerate the embedded array is greater than a second amount ofinformation contained in the bits of data, and wherein a bit of data ofthe bits of data contains a Boolean value, an integer value, a floatingpoint number, a complex value, a shape, an indicator, or an alphanumericvalue.
 15. The system of claim 13, wherein the operations furthercomprise: inputting respective embedded arrays comprising respectivegroups of bits of data to a neural network, wherein the respectivegroups of bits of data are representative of respective groups ofattributes and respective groups of relationships between attributes ofthe respective groups of attributes; and training the neural network,based on the respective groups of bits of data input to the neuralnetwork, to generate a trained neural network.
 16. The system of claim15, wherein the operations further comprise: performing an artificialintelligence-based analysis on the respective embedded arrays, inaccordance with an artificial intelligence-based process, to facilitatethe training of the neural network.
 17. The system of claim 15, whereinthe operations further comprise: inputting the bits of data of theembedded array to the trained neural network, wherein the determining ofthe pattern comprises determining, by the trained network, the patternassociated with the respective attributes and the respectiverelationships between the respective attributes based on the inputtingof the bits of data of the embedded array to the trained neural network,wherein the determining of the anomaly comprises determining, by thetrained network, the anomaly in the pattern based on a comparison of thepattern associated with the embedded array to other patterns associatedwith the respective embedded arrays, and wherein the second analysiscomprises the comparison.
 18. The system of claim 13, wherein theanomaly relates to a fraudulent activity, a churn activity, a robocallactivity, or a spam activity.
 19. A non-transitory machine-readablemedium, comprising executable instructions that, when executed by aprocessor, facilitate performance of operations, comprising: codingcharacteristics associated with an entity identity and edges between thecharacteristics to generate an embedded array comprising bits ofinformation representative of the characteristics and the edges betweenthe characteristics; determining an arrangement associated with thecharacteristics and the edges between the characteristics based on afirst analysis of the embedded array; and detecting an abnormality inthe arrangement based on a second analysis of the arrangement, whereinthe abnormality relates to an event associated with the entity identity.20. The non-transitory machine-readable medium of claim 19, wherein theoperations further comprise: applying respective embedded arrayscomprising respective groups of bits of information to a neural network,wherein the respective groups of bits of information are representativeof respective groups of characteristics and respective groups of edgesbetween characteristics of the respective groups of characteristics;training the neural network, based on the respective groups of bits ofinformation applied to the neural network, to create a trained neuralnetwork; and applying the bits of information of the embedded array tothe trained neural network, wherein the determining of the arrangementcomprises determining, by the trained network, the arrangementassociated with the respective characteristics and the respective edgesbetween the respective characteristics based on the applying of the bitsof information of the embedded array to the trained neural network,wherein the detecting of the abnormality comprises detecting, by thetrained network, the abnormality in the arrangement based on comparingthe arrangement associated with the embedded array to other arrangementsassociated with the respective embedded arrays, and wherein the secondanalysis comprises the comparing.